Senior Cyber Threat Intelligence Specialist

NinjaOne; Deutschland; Hybrid; EUR 119.000 - 179.000; Vollzeit

Zusammenfassung

A leading IT automation firm is seeking a Senior Cyber Threat Intelligence Specialist (CTI) to join their Trust team. In this role, you will enhance the CTI pipeline, own tooling and automations, and publish actionable intel reports. Experience with MITRE ATT&CK, TIP/TAXII platforms, and robust scripting skills are essential. This position offers flexibility with hybrid remote options and a comprehensive benefits package, making it ideal for professionals looking to balance work and life effectively.

Leistungen

Medical, dental, and vision insurance

401(k) plan

Unlimited PTO

Growth and advancement opportunities

Qualifikationen

• Experience translating TTPs into Sigma/SPL/KQL or YARA/EDR detection ideas.
• Familiarity with sandboxing and malware triage.
• Comfort interpreting network and endpoint artifacts.

Aufgaben

• Operate and improve the CTI pipeline.
• Own our TIP/TAXII ecosystem.
• Publish actionable reporting with clear actions for SOC/DFIR.
• Work with SOC/DFIR during active incidents.

Kenntnisse

Proven experience producing actionable intel

Strong grasp of MITRE ATT&CK

Hands-on with TIP/TAXII platform

Scripting (Python preferred)

Excellent writing and visualization skills

Near-fluent English (C1+)

Ausbildung

Relevant certifications (e.g., GCTI, GOSI, GCIA)

Tools

MISP/OpenCTI

SIEM/EDR/SOAR

Jobbeschreibung

Description

About the Role

Join our Trust team as Senior Cyber Threat Intelligence Specialist (CTI) to turn raw intelligence into action. You will own our intelligence intake, tooling, and automations. Curate and enrich external and internal intel. Publish high‑quality, actionable reporting that directly sparks hunts and new detections for our SOC (Security Operations Center) and DFIR (Digital Forensics and Incident Response) team. Partnering tightly with Detection Engineering, Incident Response, and Cloud Security to translate adversary TTPs into hypotheses, hunts, and durable detection content mapped to MITRE ATT&CK. If you love building signal pipelines as much as writing clear, decision‑ready intel, then this role is for you.

Location

We are flexible on remote working from home, if you are located in the USA and reside in one of the following states - CA, CO, CT, FL, GA, *IL, KS, MA, MD, ME, NJ, NC, NY, OR, TN, TX, VA, and WA. We have physical offices in Austin, TX and Tampa, FL, if you prefer a hybrid option.

We hire the best software engineers, but experience in our stack can’t hurt: NinjaOne is built on Java, Kotlin, C++, Golang and Postgres, supporting millions of user endpoints and running as a scalable cloud service in AWS. Knowing large‑scale datastore bottlenecks, asynchronous application design and client‑server architecture will help you.

What You’ll be Doing

• Intake, Curation & Enrichment Operate and improve the CTI pipeline: aggregate, normalize, deduplicate, and score intel from commercial, open‑source, ISAC/ISAO, and government feeds. Maintain PIRs (Priority Intelligence Requirements) with stakeholders and align reporting to those priorities. Enrich indicators and TTPs (WHOIS, passive DNS, sandboxing, URL/file reputations) and track adversary infrastructure changes over time.
• Tooling & Automations Own our TIP/TAXII ecosystem (e.g., MISP/OpenCTI or similar): uptime, schemas, tagging, TLP handling, data lifecycles, and automation jobs. Build/maintain ETL and enrichment automations (Python/PowerShell, serverless jobs, or pipelines) to reduce manual toil and noise. Integrate intel with SOC tooling (e.g., SIEM/EDR/SOAR) so hunts and detections stay fresh and relevant.
• Actionable Reporting Publish flash alerts, weekly intel briefs, and deep‑dive actor/TTP reports with clear “so‑what” and concrete actions for SOC/DFIR. Convert intel into hunt packages: hypotheses, data sources, SPL/KQL/Sigma starting points, and validation steps. Partner with Detection Engineering to propose new rules, hardening opportunities, and coverage mappings to ATT&CK/D3FEND.
• Collaboration & Governance Work side‑by‑side with SOC/DFIR during active incidents to provide rapid context (infrastructure pivots, likely next moves, IOCs). Establish sharing norms (TLP, NDA, distribution lists) and ensure compliant handling of sensitive intel. Track efficacy: closing the loop on which reports triggered hunts, detections adopted, and risk reduced.
• Other duties as needed

About You

• Bullets on Education requirements or preferences, Required or suggested experience, Technical Skills, Cross functional partners
• CTI Core: Proven experience producing actionable intel (flash notes to deep dives) tied to SOC/DFIR outcomes.
• Frameworks: Strong grasp of MITRE ATT&CK (and ideally D3FEND) for mapping intel to hunts/detections.
• Tooling: Hands‑on with a TIP/TAXII platform (MISP/OpenCTI or similar) and integrating intel into SIEM/EDR/SOAR.
• Automation: Comfortable scripting (Python preferred) for ETL, enrichment, and API integrations; basic SQL/log querying.
• Communication: Excellent writing and visualization skills—concise “so‑what,” clear action items, audience‑appropriate tone.
• Ops Mindset: Pragmatic prioritization, PIRs discipline, and respect for TLP and legal/contractual boundaries.
• English: Near‑fluent (C1+) with strong cross‑functional communication.
• You will stand out if you have expertise in:
• Experience translating TTPs into Sigma/SPL/KQL starting points or YARA/EDR detection ideas.
• Familiarity with sandboxing and malware triage; comfort interpreting network and endpoint artifacts.
• Cloud familiarity (AWS) and common security logs for hunts/detections.
• Relevant certs (e.g., GCTI, GOSI, GCIA, GCFA, AWS Security, SSCP/CISSP) or equivalent hands‑on work.

About Us

NinjaOne automates the hardest parts of IT to deliver visibility, security, and control over all endpoints for more than 30,000 customers. The NinjaOne automated endpoint management platform is proven to increase productivity, reduce security risk, and lower costs for IT teams and managed service providers. NinjaOne is obsessed with customer success and provides free and unlimited onboarding, training, and support. NinjaOne is #1 on G2 in endpoint management, patch management, remote monitoring and management, and mobile device management.

What You’ll Love

We are a collaborative, kind, and curious community.

We honor your flexibility needs with full‑time work that is hybrid remote.

We have you covered with our comprehensive benefits package, which includes medical, dental, and vision insurance.

We help you prepare for your financial future with our 401(k) plan.

We prioritize your work‑life balance with our unlimited PTO.

We reward your work with opportunities for growth and advancement.

Additional Information

This position is NOT eligible for Visa sponsorship.

Due to federal government security requirements associated with our FedRAMP‑authorized environment, candidates must be U.S. citizens or lawful permanent residents.

*Due to operational policies, NinjaOne is unable to hire for this role within the city limits of Chicago. We will consider all qualified candidates who reside outside of the city properly or are willing to self‑relocate.

Starting pay for the successful applicant depends on a variety of job‑related factors, including but not limited to location, market demands, experience, job‑related knowledge, and skills. The benefits available for this position include medical, dental, vision, 401(k) plan, life insurance coverage and PTO. For roles based in California, Colorado, Maryland, New Jersey, or Washington the base salary hiring range for this position is $140,000 to $210,000 per year.

For roles based in New York, the base salary hiring range for this position is $140,000 to $210,000 per year.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.

#LI-MM1

#LI-Remote

#BI-Remote

#BI-Hybrid