Threat Intelligence Automation Engineer

The Planet Group; Exton (PA); Hybrid; USD 103,320 - 117,096; Full time

Job summary

The Planet Group is seeking a hands-on cybersecurity engineer in Malvern, PA to modernize CTI capabilities by building automated pipelines, API integrations, and threat data workflows across security operations.

You will automate intel collection, enrich and distribute IOCs, integrate TIPs, SOAR, SIEM, EDR via REST APIs and webhooks, and collaborate with Incident Response and Detection Engineering to replace manual processes.

Qualifications

• 6+ years of cybersecurity experience with a focus on Security Automation, Engineering, DevSecOps, or Software Development.

Responsibilities

• Automate Intel: Build Python pipelines to collect, enrich, score, and distribute IOCs across enterprise security tools.

Skills

Python

REST APIs

CTI concepts

Security Automation

Threat Intelligence Platforms

SOAR/SIEM/EDR integration

Incident Response collaboration

Job description

This is a hands-on engineering position focused on modernizing CTI capabilities by building automated pipelines, API integrations, and streamlining threat data workflows across security operations.

• Location: Malvern, PA ( 3 days onsite)
• Duration: 12-Month Contract
• Core Tech Stack: Python, REST APIs/Webhooks, TIP, SOAR, SIEM, EDR, STIX/TAXII
• Pay : $75-85/hr

What You’ll Be Doing

• Automating Intel: Build Python pipelines to collect, enrich, score, and distribute IOCs across enterprise security tools.
• Integrations: Connect TIPs, SOAR, SIEM, EDR, and cloud platforms using REST APIs and webhooks.
• Correlate Vulnerabilities: Automate processes linking vulnerability intel (CISA KEV, NVD) with exploit activity and asset exposure.
• Cross-Team Collaboration: Work directly with Incident Response, Threat Hunting, and Detection Engineering to replace manual workflows.

What We’re Looking For

• 6+ years of cybersecurity experience (with a focus on Security Automation, Engineering, DevSecOps, or Software Development).
• Strong Python skills and deep experience with REST APIs & structured data (JSON/XML).
• Solid grasp of CTI concepts and standards (STIX/TAXII, Threat Intelligence Platforms).
• Prior experience integrating enterprise security stacks (SIEM, SOAR, EDR, Cloud).