Allianz - Threat Intelligence Engineer - Security Operations Center

Allianz PNB Life; Thiruvananthapuram; On-site; INR 2,000,000 - 3,500,000; Full time

Job summary

Allianz PNB Life is seeking a Threat Intelligence Analyst to join our Security Operations/CTI team in India. You will monitor evolving threats, produce analytical products, and collaborate with detection engineers and incident responders to strengthen defenses.

Ideal candidates have threat intelligence experience, knowledge of the Threat Intelligence Lifecycle and MITRE ATT&CK, plus Python or scripting skills for automation. Strong English and ability to work under pressure are essential.

Qualifications

• Experience in threat intelligence, threat monitoring, or SOC/CTI operations.
• Knowledge of Threat Intelligence Lifecycle and frameworks (Diamond Model, Kill Chain, MITRE ATT&CK).
• Ability to communicate analytical products to varying technical audiences with strong English.
• Hands-on technical ability in Python or scripting, API integrations, and lightweight workflow building.

Skills

Threat intelligence operations

Threat monitoring

English communication

Python/scripting

AI/GenAI integration

Incident response

Time management under pressure

Tools

Python

Scripting

Threat Intelligence Platform

Job description

• Experience in threat intelligence, threat monitoring, or SOC/CTI operations.
• Solid grounding in the Threat Intelligence Lifecycle and structured analytical techniques, and frameworks such as the Diamond Model, Kill Chain, and MITRE ATT&CK.
• Ability to produce clear, accurate analytical products and communicate them to audiences of varying technical depth, with excellent English language skills.
• Hands-on technical ability - Python or scripting, API integrations, and lightweight workflow building.
• Working knowledge of detection logic and telemetry.
• Experience with at least one Threat Intelligence Platform, ideally Google Threat Intelligence / VirusTotal, CrowdStrike Intelligence, or Recorded Future.
• An AI-native working style - you integrate LLMs and automation tools into your daily monitoring, enrichment, and analytical workflow.
• Composure under pressure - you deliver clearly and effectively during incidents and time-critical escalations.

Required

• Experience in threat intelligence, threat monitoring, or SOC/CTI operations.
• Solid grounding in the Threat Intelligence Lifecycle and structured analytical techniques, and frameworks such as the Diamond Model, Kill Chain, and MITRE ATT&CK.
• Ability to produce clear, accurate analytical products and communicate them to audiences of varying technical depth, with excellent English language skills.
• Hands-on technical ability - Python or scripting, API integrations, and lightweight workflow building.
• Working knowledge of detection logic and telemetry.
• Experience with at least one Threat Intelligence Platform, ideally Google Threat Intelligence / VirusTotal, CrowdStrike Intelligence, or Recorded Future.
• An AI-native working style - you integrate LLMs and automation tools into your daily monitoring, enrichment, and analytical workflow.
• Composure under pressure - you deliver clearly and effectively during incidents and time-critical escalations.

Preferred

• Background in Incident Response, SOC operations, or digital forensics.
• Hands-on detection engineering experience, ideally authoring rules in Google SecOps or CrowdStrike.
• Prior experience in IT administration (server, network, endpoint).
• SANS FOR578 (Cyber Threat Intelligence) or equivalent certification.
• Familiarity with threat sharing platforms (MISP) and large-scale IOC management.
• Experience with SOAR platforms, N8N, or Power Automate.
• Data and Process visualization proficiency (Grafana, advanced Excel, PowerPoint).
• Certifications: GIAC (GCTI, GCIH, GCFA), CISSP, or OSCP.

Who You Are

• A bridge-builder - you are equally comfortable with an analyst's judgment and an engineer's toolkit.
• Vigilant and curious - you notice what others scroll past.
• A builder - you identify gaps and close them without waiting for instruction.
• Autonomous and outcome-driven.
• A communicator - you understand that ultimately people execute defenses.
• Energized by transformation.
• Process-aware without being process-bound.
• Collaborative across boundaries - in our pooled model, you will work across squads (Monitoring, Intrusion Analysis, TTP & Threat Actor Analysis, IOC Handling) and partner daily with detection engineers and incident responders.
• Exposure in AI, GenAI and Agentic AI preferred.