Senior Threat Intelligence Automation Engineer

Voiceflow; Seattle (WA); On-site; USD 100,000 - 180,000; Full time

Benefits offered by this job

Top-tier medical, dental, and vision benefits

Relocation expenses covered

Equity options

Job summary

Galvanick in Seattle is seeking a Senior Threat Intelligence Automation Engineer to set up and direct our threat intelligence program. This role involves designing how we operationalize threat intelligence to shield critical infrastructure, bridging the gap between raw data and actionable insights.

The ideal candidate will have a robust background in threat intelligence, experience with operational technology environments, and the ability to build relationships with intelligence communities. Competitive compensation and benefits are provided.

Qualifications

• Deep expertise in threat intelligence consumption and operationalization for security operations.
• Experience in implementing threat intelligence platforms and frameworks.
• Ability to design and build intelligence programs from scratch.

Responsibilities

• Define and implement the threat intelligence strategy for Galvanick.
• Drive integration of threat intelligence into detection engineering workflows.
• Build relationships with intelligence communities and government agencies.

Skills

Threat intelligence expertise

Python proficiency

Knowledge of STIX/TAXII frameworks

Malware investigation

Familiarity with ICS/SCADA

Job description

About the Role

We are seeking a Senior Threat Intelligence Automation Engineer to establish and lead Galvanick's threat intelligence program. In this role, you will architect our intelligence capabilities, defining how we consume, produce, and operationalize threat intelligence to protect critical infrastructure. You will bridge the gap between raw intelligence and actionable detections, ensuring our platform stays ahead of evolving threats to Operational Technology environments.

Responsibilities

• Define and implement Galvanick's comprehensive threat intelligence strategy, establishing processes for consuming, analyzing, and producing actionable intelligence specific to OT/ICS environments.
• Drive integration of threat intelligence sources directly into our detection engineering workflow, ensuring new detections are informed by the latest adversary tactics, techniques, and procedures.
• Design and define technical requirements for our threat intelligence platform and system of record, selecting and implementing tools that scale with our growth.
• Operationalize threat intelligence at runtime, ensuring real‑time correlation between intelligence feeds and active threat detection across customer environments.
• Build relationships with intelligence sharing communities, government agencies, and industry partners to enhance our understanding of threats targeting critical infrastructure.
• Develop intelligence products and reports informing internal teams and customer decision‑making, translating complex threat landscapes into actionable insights.
• Experiment with and iterate on intelligence integration methods, continuously improving how we transform raw intelligence into high‑fidelity detections and hunting hypotheses.

Qualifications

• Experience in threat intelligence, with deep expertise in consuming, analyzing, and operationalizing intelligence for security operations or detection engineering.
• Strong technical background implementing threat intelligence platforms (TIPs) and STIX/TAXII frameworks, with Python (or Go) proficiency for automating intelligence workflows.
• Proven ability to translate strategic intelligence requirements into technical implementations; experience designing and building intelligence programs from the ground up.
• Experience working with intelligence sharing communities, ISACs, and government intelligence sources, with an understanding of TLP and intelligence handling requirements.
• Demonstrated expertise investigating malware, phishing, web attacks, insider threats, and advanced persistent threats.

Bonus Points

• Experience with industrial control systems, SCADA, or operational technology environments and understanding of threats specific to critical infrastructure.
• Active involvement in the threat intelligence community with established relationships in industry and government intelligence circles.
• Published research, conference presentations, or contributions to open‑source intelligence projects.
• Experience working in startup environments where you've built capabilities with limited resources while maintaining high quality standards.

Benefits

We provide top‑of‑the‑line medical, dental, vision, and additional benefits designed to optimize every team member’s vitality, health, and wellness. Compensation ranges from $100,000 per year (lowest market) to $180,000 per year (highest market). Salary may vary by location and experience. Equity may also be provided.

Location

The Galvanick team is based in Seattle. We expect new team members to be in office and will cover relocation expenses.

ITAR Requirements

To conform to US Government export regulations (ITAR) you must be a US citizen, lawful permanent resident, protected individual, or eligible to obtain required authorizations. Galvanick is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, disability, veteran status, sexual orientation, gender identity, or any other protected status.