AI-Driven Threat Intelligence Engineer

Cyware; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive compensation

Career growth opportunities

Comprehensive benefits package

Diversity and inclusion

Job summary

Cyware is seeking a Threat Intelligence Engineer in the United States to map feeds to STIX 2.1, design robust mappings, and own the connector portfolio. You will validate data models with live payloads, manage the full connector lifecycle, and collaborate with partners to accelerate engineering with AI.

You will bring 5+ years in threat intelligence, deep STIX/TAXII knowledge, and strong Python and AI fluency.

Qualifications

• US citizenship is required in accordance with applicable law.
• 5+ years in threat intelligence as an analyst, engineer, or specialist.
• Deep knowledge of STIX/TAXII 2.1 objects, relationships, and mappings.
• Hands-on experience with threat feeds and enrichment sources.
• Proficient Python for API clients, parsers, and validators.
• Practical AI fluency for schema inference and data mapping.

Responsibilities

• Map feeds to STIX and own the connector portfolio.
• Design mappings from feeds into STIX 2.1 objects and extensions.
• Inspect live payloads to ground truth data models.
• Own connector lifecycle from onboarding to schema drift detection.
• Collaborate with feed, sandbox, DRP, and enrichment partners.
• Build an AI-assisted mapping workflow with validation and oversight.
• Write threat intel use cases for product design and testing.
• Represent Cyware on MITRE and industry alliance committees.

Skills

Threat intel

STIX/TAXII

Python

AI in security

MITRE ATT&CK

Cross-functional

Tools

CrowdStrike

Mandiant

Recorded Future

MISP

Job description

Cyware is seeking a Threat Intelligence Engineer in the United States to map feeds to STIX 2.1, design robust mappings, and own the connector portfolio. You will validate data models with live payloads, manage the full connector lifecycle, and collaborate with partners to accelerate engineering with AI.

You will bring 5+ years in threat intelligence, deep STIX/TAXII knowledge, and strong Python and AI fluency.