Cyber Threat Engineer

247Hire; Vienna (VA); On-site; USD 110,000 - 160,000; Full time

Job summary

247Hire is seeking a cybersecurity engineer to develop and maintain threat-hunting tools, scripts, and automated workflows. You will build repeatable data collection and enrichment processes, develop YARA and SIGMA rules, and translate analyst needs into scalable technical solutions.

Apply MITRE ATT&CK to detections and integrate threat intel sources into workflows. The role emphasizes QA, troubleshooting, and documentation, with a preference for advanced degrees and strong security

Qualifications

• Bachelor's degree preferred; relevant experience may be considered in lieu of degree.
• Master's degree strongly preferred; comparable advanced qualifications may be considered.
• Demonstrated experience in cybersecurity engineering, security automation, or threat engineering.
• Direct experience supporting Cyber Threat Intelligence or threat-hunting function required.
• Experience with Python (3+ years), script-based automation, and YARA/SIGMA rule development.
• Practical experience applying MITRE ATT&CK to use cases.

Responsibilities

• Develop and maintain tools, scripts, and automated workflows for threat-hunting operations.
• Build repeatable processes for collecting, enriching, transforming, and operationalizing threat data.
• Develop, test, and maintain YARA rules and supporting detection processes.
• Create Python-based utilities to reduce manual effort and improve scalability.
• Translate analyst needs into technical solutions and automated capabilities.
• Apply MITRE ATT&CK framework in tool development and detections.
• Integrate internal and external threat intelligence into workflows and tools.
• Validate quality and perform QA for tools, scripts, rules, and integrations.
• Troubleshoot and maintain pipelines, integrations, and automation.
• Maintain technical documentation and procedures for capabilities.

Skills

Python

Threat-hunting

Security automation

YARA rule development

Sigma rule development

MITRE ATT&CK

Education

Bachelor's degree in cybersecurity or related field

Master's degree preferred

Tools

YARA

Sigma rules

Python scripting

Automation workflows

Job description

Key Responsibilities:

• Develop and maintain tools, scripts, and automated workflows that enable TIER threat-hunting and intelligence operations.
• Build repeatable processes for collecting, ingesting, enriching, transforming, and operationalizing threat intelligence data.
• Develop, test, document, and maintain YARA rules and supporting detection processes.
• Create Python-based utilities and script automation that reduce manual effort and improve workflow scalability.
• Translate analyst requirements into technical solutions, integrations, automated processes, and reusable capabilities.
• Apply the MITRE ATT&CK framework when developing threat-hunting tools, detections, and supporting processes.
• Integrate internal and external threat intelligence sources into TIER workflows and supporting tools.
• Validate and perform quality assurance for tools, scripts, rules, integrations, and automation before operational use.
• Troubleshoot and maintain TIER tools, data pipelines, integrations, and automated workflows.
• Maintain technical documentation and procedures needed to sustain developed capabilities.

Preferred Qualifications:

• Bachelor's degree in cybersecurity, computer science, information technology, information systems, engineering, or a related technical discipline preferred; relevant experience may be considered in lieu of a degree.
• Master's degree in cybersecurity, information assurance, computer science, or a comparable technical discipline strongly preferred; comparable advanced technical qualifications or demonstrated expertise may be considered.
• Demonstrated experience in cybersecurity engineering, security automation, or threat engineering.
• Direct experience supporting Cyber Threat Intelligence or threat-hunting function required.
• Demonstrated experience with Python (3+ years), script-based automation, and YARA and SIGMA rule development.
• Practical experience applying the MITRE ATT&CK framework to cybersecurity or threat-hunting use cases.
• Security+, CySA+, GCIH, GCIA, or comparable cybersecurity certifications preferred, but not required.