Senior Director, Threat Intelligence

Kroll; United States; Hybrid; USD 200,000 - 300,000; Full time

Benefits offered by this job

Healthcare Coverage

Time Off and Leave Policies

Protective Insurances

Compensation and Rewards

Retirement Plans

Job summary

Kroll is seeking an experienced Threat Intelligence Platform Engineer to join our Cyber Threat Intelligence team in the United States. This role engineers scalable threat intelligence capabilities through automation, data integration, and platform management, bridging intelligence analysis, threat research, data engineering, and security operations.

You will design ETL pipelines, integrate with OSINT, commercial feeds, and government sources, and build dashboards and automation to support threat

Qualifications

• Minimum five years in cybersecurity, threat intel, or security engineering.
• Experience administering a Threat Intelligence Platform (EclecticIQ preferred).
• Proven automation design using Python and API integration.
• Hands-on TI workflows and intelligence lifecycle management.

Responsibilities

• Administer, maintain, and optimize Kroll’s Threat Intelligence Platform.
• Design automated workflows for collecting, enriching, correlating, and distributing TI.
• Build scalable automation for dark web monitoring and threat activity tracking.
• Develop integrations with TI providers, OSINT, government feeds, and internal platforms.
• Design ETL pipelines to ingest, normalize, and organize TI datasets.
• Correlate IOCs, threat actors, malware families, and campaigns using STIX/TAXII and MITRE ATT&CK.
• Develop dashboards, reporting, and visualizations for analysts and stakeholders.
• Evaluate new tech and AI-driven capabilities to improve TI operations.

Skills

Malware intel

Threat intel

Automation design

Python development

Data integration

Threat actor tracking

Education

Bachelor's degree in CS or related

Equivalent professional experience

Tools

PostgreSQL

Elasticsearch/OpenSearch

MongoDB

Selenium or Playwright

SQLAlchemy

Job description

Technical Qualifications

• Malware intelligence
• PostgreSQL

As the leading independent provider of risk and financial advisory solutions, Kroll leverages our unique insights, data, and technology to help clients stay ahead of complex cyber threats. Our Cyber Risk team partners with organizations around the world to deliver intelligence-driven security solutions that enable informed decision-making and proactive risk management.

We are seeking an experienced Threat Intelligence Platform Engineer to join our Cyber Threat Intelligence team. This role is ideal for a security professional who is passionate about engineering scalable threat intelligence capabilities through automation, data integration, and platform management.

The Intelligence Platform Engineer is responsible for designing, building, and maintaining the technology, automation, and data infrastructure that powers cyber threat intelligence operations. This role serves as the bridge between intelligence analysis, threat research, data engineering, and security operations by developing scalable solutions that automate the collection, enrichment, normalization, correlation, and dissemination of cyber threat intelligence.

The successful candidate will identify and integrate intelligence data sources from commercial providers, open-source intelligence (OSINT), internal security telemetry, dark web collections, government feeds, and industry-sharing communities. They will leverage automation, APIs, machine learning, and data engineering techniques to transform raw intelligence into actionable insights that support threat detection, incident response, vulnerability management, executive reporting, and strategic decision-making. This aligns with internal descriptions emphasizing ownership of a threat intelligence platform, automation, and multi-source intelligence integration.

Working closely with Threat Intelligence Analysts, Incident Responders, Detection Engineers, and Security Operations teams, the successful candidate will improve the organization's ability to identify emerging threats through intelligent automation and data engineering.

Key Responsibilities

• Administer, maintain, and optimize Kroll’s Threat Intelligence Platform.
• Design and develop automated workflows for collecting, enriching, correlating, and distributing cyber threat intelligence.
• Build scalable automation to support dark web monitoring, credential exposure tracking, threat actor activity, and emerging threat detection.
• Develop and maintain integrations with commercial threat intelligence providers, OSINT sources, government intelligence feeds, ISACs, and internal security platforms.
• Design ETL pipelines to ingest, normalize, and organize structured and unstructured threat intelligence datasets.
• Correlate indicators of compromise (IOCs), threat actors, malware families, vulnerabilities, and campaigns using industry standards such as STIX/TAXII and the MITRE ATT&CK Framework.
• Develop dashboards, reporting, and visualizations that improve analyst efficiency and provide actionable intelligence to stakeholders.
• Evaluate emerging technologies, intelligence sources, and AI-driven capabilities to continuously improve Kroll's threat intelligence operations.
• Ensure data quality, governance, and security across all intelligence repositories.

Required Qualifications

Education

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related discipline, or equivalent professional experience.

Experience

• Minimum of five (5) years of experience in cybersecurity, cyber threat intelligence, or security engineering.
• Experience administering a Threat Intelligence Platform (EclecticIQ strongly preferred).
• Proven experience designing automation solutions using Python.
• Experience integrating APIs and external data sources.
• Hands‑on experience with cyber threat intelligence workflows and intelligence lifecycle management.

Technical Qualifications

Threat Intelligence

• Experience working Threat Intelligence Platforms
• STIX 2.x and TAXII
• MITRE ATT&CK Framework
• MISP (preferred)
• IOC lifecycle management
• Threat actor tracking
• Campaign analysis
• Malware intelligence
• TTP analysis

Programming & Automation

Required

• Advanced Python development

Experience With

• REST APIs
• Webhooks
• Async programming
• Requests
• Pandas
• BeautifulSoup
• Selenium or Playwright
• SQLAlchemy

Preferred

• JavaScript
• PowerShell
• Go

Data Engineering

Experience With

• SQL
• PostgreSQL
• Elasticsearch/OpenSearch
• MongoDB (preferred)

Ability To

• Build ETL pipelines
• Normalize structured and unstructured datasets
• Correlate multiple intelligence sources
• Design scalable data ingestion workflows

Dark Web Intelligence

Experience Collecting And Automating Intelligence From

• Underground forums
• Telegram channels
• Credential leak repositories
• Marketplace monitoring
• Paste sites

  Cloud & Infrastructure

  Experience With AWS Services Including

  • Lambda
  • ECS
  • S3
  • IAM
  • EventBridge
  • Step Functions
  • Secrets Manager

  Security Platforms

  Experience Integrating With Technologies Such As

  • Splunk
  • CrowdStrike Falcon
  • VirusTotal
  • GreyNoise
  • Shodan
  • Censys

  Preferred Qualifications

  • Experience developing AI-assisted threat intelligence workflows.
  • Familiarity with Large Language Models (LLMs) for intelligence summarization and analysis.
  • Experience with graph databases such as Neo4j.
  • Knowledge of Retrieval-Augmented Generation (RAG) architectures.
  • Experience building knowledge graphs.
  • Familiarity with DevOps practices, Docker, Kubernetes, and CI/CD pipelines.

  Preferred Certifications

  • GIAC Cyber Threat Intelligence (GCTI)
  • SANS FOR578 Cyber Threat Intelligence
  • CISSP
  • AWS Certified Security – Specialty
  • AWS Certified Developer – Associate
  • Security+
  • GSEC

  What Success Looks Like

  The successful candidate will:

  • Build scalable automation that significantly reduces manual intelligence collection and analysis.
  • Improve analyst productivity through efficient data integration and workflow automation.
  • Expand Kroll's ability to monitor the dark web and emerging threat landscape.
  • Deliver actionable, high-quality intelligence through a modern, integrated Threat Intelligence Platform.
  • Help position Kroll as an industry leader in intelligence-driven cybersecurity services through continuous innovation and operational excellence.

  Why Join Kroll?

  At Kroll, you'll work alongside some of the industry's most respected cyber professionals, solving complex challenges for organizations around the world. We foster a collaborative, innovation-driven environment where your expertise directly contributes to protecting clients from evolving cyber threats. You'll have the opportunity to work with cutting-edge technologies, influence the evolution of our threat intelligence capabilities, and make a meaningful impact across our global Cyber Risk practice.

  • Healthcare Coverage: Comprehensive medical, dental, and vision plans.
  • Time Off and Leave Policies: Generous paid time off (PTO), paid company holidays, generous parental and family leave.
  • Protective Insurances: Life insurance, short- and long-term disability coverage, and accident protection.
  • Compensation and Rewards: Competitive salary structures, performance-based incentives, and merit-based compensation reviews.
  • Retirement Plans: 401(k) plans with company matching.

  About Kroll

  Join the global leader in risk and financial advisory solutions—Kroll. With a nearly century-long legacy, we blend trusted expertise with cutting‑edge technology to navigate and redefine industry complexities. As a part of One Team, One Kroll, you'll contribute to a collaborative and empowering environment, propelling your career to new heights. Ready to build, protect, restore and maximize our clients’ value? Your journey begins with Kroll.

  We are proud to be an equal opportunity employer and will consider all qualified applicants regardless of gender, gender identity, race, religion, color, nationality, ethnic origin, sexual orientation, marital status, veteran status, age or disability.

  Please note that benefits may vary by region, department and role. We encourage you to speak with your recruiter to learn more about the specific benefits available for your position.

  The current salary range for this position is $200,000 to $300,000