Threat Intelligence Engineer_3377

Allianz Technology; Thiruvananthapuram; Sur place; INR 900 000 - 1 500 000; Plein temps

Résumé du poste

Allianz Technology is seeking a Threat Intelligence Analyst to join our security operations team in India. You will monitor real environments, apply structured analytic techniques, and translate signals into actionable intelligence.

You will build lightweight automation, scripts, and integrations to improve detection and response against evolving threats. The role requires strong English communication, a solid grasp of cyber threat intelligence lifecycle frameworks, and experience with at least

Qualifications

• Experience in threat intelligence, monitoring, or SOC/CTI operations in real environments.
• Strong knowledge of the Threat Intelligence Lifecycle and frameworks (Diamond Model, Kill Chain, MITRE ATT&CK).
• Ability to produce clear, accurate analytical products and communicate to audiences with varying technical depth in English.
• Hands-on technical ability in Python or scripting, APIs, and lightweight workflow building.
• Working knowledge of detection logic and telemetry; read and contribute to detection rules and hunting leads.
• Experience with at least one Threat Intelligence Platform (Google Threat Intelligence, VirusTotal, CrowdStrike Intelligence, or Recorded Future).
• AI-native working style; integrate LLMs and automation tools into monitoring and enrichment workflows.
• Calm and effective under pressure during incidents and escalations.

Connaissances

Threat intelligence

Threat monitoring

SOC/CTI operations

Threat intelligence lifecycle

Diamond model

Kill chain

MITRE ATT&CK

Analytical storytelling

Python scripting

APIs

Automation/workflows

Telemetry/detection logic

Threat intel platforms

AI/GenAI in security

Incident response

Communication in English

Outils

Threat Intelligence Platform

Google Threat Intelligence

VirusTotal

CrowdStrike Intelligence

Recorded Future

Description du poste

Required

• Experience in threat intelligence, threat monitoring, or SOC/CTI operations – you have kept watch over real environments and know what a meaningful signal looks like
• Solid grounding in the Threat Intelligence Lifecycle and structured analytical techniques, and frameworks such as the Diamond Model, Kill Chain, and MITRE ATT&CK
• Ability to produce clear, accurate analytical products and communicate them to audiences of varying technical depth, with excellent English language skills
• Hands-on technical ability – Python or scripting, API integrations, and lightweight workflow building; you build tools, not only use them
• Working knowledge of detection logic and telemetry – you can read, reason about, and contribute to detection rules and hunting leads
• Experience with at least one Threat Intelligence Platform, ideally Google Threat Intelligence / VirusTotal, CrowdStrike Intelligence, or Recorded Future
• An AI-native working style – you integrate LLMs and automation tools into your daily monitoring, enrichment, and analytical workflow
• Composure under pressure – you deliver clearly and effectively during incidents and time‑critical escalations

Preferred

• Background in Incident Response, SOC operations, or digital forensics
• Hands‑on detection engineering experience, ideally authoring rules in Google SecOps or CrowdStrike
• Prior experience in IT administration (server, network, endpoint) – understanding what you are defending at infrastructure level
• SANS FOR578 (Cyber Threat Intelligence) or equivalent certification
• Familiarity with threat sharing platforms (MISP) and large‑scale IOC management
• Experience with SOAR platforms, N8N, or Power Automate
• Data and Process visualization proficiency (Grafana, advanced Excel, PowerPoint)
• Certifications: GIAC (GCTI, GCIH, GCFA), CISSP, or OSCP

Who You Are

• A bridge-builder — you are equally comfortable with an analyst’s judgment and an engineer’s toolkit, and you connect the two without friction
• Vigilant and curious — you notice what others scroll past, and you follow a faint signal until you know what it means
• A builder — you identify gaps and close them without waiting for instruction
• Autonomous and outcome-driven — you execute decisively, follow guidelines, and report after; action precedes permission
• A communicator — you understand that ultimately people execute defenses, and people must understand what you produce
• Energized by transformation — an unfinished environment is an opportunity, not a problem
• Process‑aware without being process‑bound — you operate with discipline, can justify your decisions under scrutiny, but never let procedure prevent progress
• Collaborative across boundaries — in our pooled model, you will work across squads (Monitoring, Intrusion Analysis, TTP & Threat Actor Analysis, IOC Handling) and partner daily with detection engineers and incident responders
• Exposure in AI ,GenAI and Agentic AI preffered.

Allianz Group is one of the most trusted insurance and asset management companies in the world. Caring for our employees, their ambitions, dreams and challenges, is what makes us a unique employer. Together we can build an environment where everyone feels empowered and has the confidence to explore, to grow and to shape a better future for our customers and the world around us.

At Allianz, we stand for unity: we believe that a united world is a more prosperous world, and we are dedicated to consistently advocating for equal opportunities for all. And the foundation for this is our inclusive workplace, where people and performance both matter, and nurtures a culture grounded in integrity, fairness, inclusion and trust.

We therefore welcome applications regardless of ethnicity or cultural background, age, gender, nationality, religion, social class, disability or sexual orientation, or any other characteristics protected under applicable local laws and regulations.

Great to have you on board. Let's care for tomorrow.