Threat Collections Engineer

📋 Description

• Build automated detection systems that use disparate signals to identify abusive behavior.
• Take systems from idea to proof-of-concept to production-grade with appropriate monitoring, documentation, and maintenance processes
• Develop and maintain YARA rule infrastructure, including tools for writing, validating, and testing rules against real data
• Create integrations with external threat intelligence platforms (e.g. VirusTotal, Censys, Urlscan) via MCP servers to enable multi-source correlation during investigations
• Build data pipelines that ingest intelligence from RSS feeds, CTI news sources, and partner sharing, using Claude to extract TTPs and generate targeted hunting queries
• Develop behavioral analytics capabilities using DBT-based frameworks and create searchable audit logging infrastructure

🎯 Requirements

• Have strong coding proficiency in Python and SQL for building detection logic, data pipelines, and automation
• Have experience with data pipeline orchestration tools (Airflow, DBT, or similar)
• Have familiarity with threat intelligence concepts including IOCs, YARA rules, and threat correlation techniques
• Have experience integrating external APIs and building data ingestion systems
• Can translate investigator needs and workflows into technical requirements
• Are comfortable building v0 systems and iterating based on user feedback

🎁 Benefits

• Flexible working hours
• Generous vacation and parental leave
• Office space for collaboration
• Optional equity donation matching