Security Engineer

emergiTEL Inc.; Calgary; Hybrid; CAD 80,000 - 100,000; Full time

Job summary

A technology consulting firm seeks a Threat Intelligence Security Engineer for a contract position in Calgary. The role requires hands-on involvement with threat intelligence platforms, leading threat hunts, and translating technical data into actionable intelligence. Candidates should have strong Python skills and a solid understanding of cyber threats, particularly in the financial sector. A mandatory one-day-per-week on-site presence is required. This role is vital for maximizing ROI from threat intelligence tools.

Qualifications

• Experience with threat intelligence platforms like Anomali ThreatStream and Mandiant.
• Proficient in Python for automation and scripting tasks.
• Understanding of the MITRE ATT&CK Framework.

Responsibilities

• Contribute to Threat Intelligence Platforms and develop custom scripts.
• Lead Threat Hunts and create intelligence reports.
• Profile cyber threat actors relevant to the financial sector.

Skills

Python

Threat Intelligence Platforms

APIs

Threat Hunting

Job description

The Threat Intelligence Security Engineer

Hands‑on, contract position responsible for operationalizing, measuring, and maximizing ROI from external threat intelligence assets and monitoring tools.

Role requires a mandatory one‑day‑per‑week on‑site presence in either the Calgary or Edmonton office.

Key Responsibilities

• Serve as a core contributor and technical resource for Threat Intelligence Platforms (Anomali ThreatStream and Mandiant/Google Threat Intelligence).
• Develop custom queries, API integrations, and scripting (primarily Python) to automate ingestion, enrichment, and correlation of IOCs and actor TTPs from all feeds.
• Lead planning, execution, and formal reporting of intelligence‑driven Threat Hunts, developing hypotheses based on current threat actor TTPs (mapped via MITRE ATT&CK), coordinating execution across multiple defensive teams (SOC, IR), validating new detection opportunities, and ensuring all activity delivers measurable value to defense operations.
• Translate complex technical analysis (tactical data) into clear, context‑rich operational and strategic intelligence reports, ensuring timely and targeted dissemination to IR, SOC, and executive stakeholders.
• Proactively track and profile cyber threat actors relevant to the financial sector, mapping their capabilities and infrastructure to the MITRE ATT&CK Framework.
• Collaborate with Security Operations and Vulnerability Management teams to implement new detection rules, fine‑tune existing security controls based on validated threat intelligence, and write clear, concise documentation (SOPs, Job Aids) to codify new processes.