Threat Intelligence Security Engineer
-
Pay Rate: $74 - $85/hour, depending on experience
-
Contract Length: 2 Months, with the possibility of an extension
-
Location: Calgary or Edmonton Alberta
-
This role requires a mandatory one-day-per-week on-site presence in either the Calgary or Edmonton office.
Raise is currently hiring a Threat Intelligence Security Engineer on behalf of our client. They’re expanding their team to meet growing needs, making this a unique opportunity to work with an industry leader. Our Client is a market leading financial institution
Description
The Threat Intelligence Security Engineer is a hands-on, contract position responsible for operationalizing, measuring, and maximizing the return on investment (ROI) from the organization's external threat intelligence assets and monitoring tools. This role is critical for transforming raw data from premium sources into actionable, quantifiable defense strategies and providing clear, decisive analysis that demonstrates value and impact to senior leadership and other teams. This role requires a mandatory one-day-per-week on-site presence in either the Calgary or Edmonton office.
Responsibilities
-
TIP Management & Optimization: Serve as a core contributor and technical resource for our Threat Intelligence Platforms (TIPs), specifically Anomali ThreatStream and Mandiant/Google Threat Intelligence.
-
Value Extraction & Automation: Actively develop custom queries, API integrations, and scripting (primarily Python) to automate the ingestion, enrichment, and correlation of IOCs and actor TTPs from all feeds.
-
End-to-End Threat Hunting Leadership: Lead the planning, execution, and formal reporting of intelligence-driven Threat Hunts. This includes developing clear hypotheses based on current threat actor TTPs (mapped via MITRE ATT&CK), coordinating execution across multiple defensive teams (e.g., SOC, IR), validating new detection opportunities, and ensuring all activity delivers measurable value back to defense operations.
-
Intelligence Production & Dissemination: Translate complex technical analysis (tactical data) into clear, context-rich operational and strategic intelligence reports, ensuring timely and targeted dissemination to IR, SOC, and executive stakeholders.
-
Adversary Profiling: Proactively track and profile cyber threat actors relevant to the financial sector, mapping their capabilities and infrastructure to the MITRE ATT&CK Framework.
-
Defensive Enhancement & Process Codification: Collaborate actively with Security Operations and Vulnerability Management teams to implement new detection rules, fine-tune existing security controls based on validated threat intelligence, and write clear, concise documentation (SOPs, Job Aids) to codify new processes
Qualifications
-
5+ years of experience in Cybersecurity, with at least 3 years specifically focused on Threat Intelligence or Threat Hunting within an enterprise environment (Financial Services experience is a strong asset).
-
Proficiency in Python is required for API integrations and data automation. Experience with PowerShell or Bash is a plus.
-
Platform Expertise: Direct experience managing Threat Intelligence Platforms (TIPs), specifically Anomali ThreatStream and/or Mandiant/Google Threat Intelligence.
-
Framework Knowledge: Expert-level understanding of the MITRE ATT&CK Framework and its application in mapping adversary behavior.
-
Security Tools: Familiarity with SIEM/EDR platforms (e.g., Sentinel, CrowdStrike, Splunk) for correlation and detection validation.
-
Analysis: Strong ability to conduct "Deep Dive" analysis into malware families, campaign infrastructure, and actor motivations.
-
Strong technical writing skills for creating SOPs, playbooks, and intelligence reports.
-
Proven track record of working across teams (SOC, IR, and VM) to achieve a unified defensive goal.
-
Education and Skills
-
Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent professional experience).
-
Certifications (Preferred)
-
Threat Intelligence specific: GCTI (GIAC Cyber Threat Intelligence) or CTIM (Certified Threat Intelligence Manager).
-
General Security: CISSP (Certified Information Systems Security Professional) or CCSP.
-
Incident Response/Hunting: GCFA (GIAC Certified Forensic Analyst) or GCFE.
-
Ability to distill complex technical threats into "business-ready" language for executive briefings.
-
Analytical Mindset -A "hunter" mentality with the ability to form logical hypotheses from disparate data points.
Additional Information
-
A requirement for candidates to be considered for this role will be to complete a criminal and credit check (including Canadian Credit Risk Score)
Looking for meaningful work? We can help!
Raise is an established hiring firm with over 65 years of experience. We believe strongly in making the world a better place through work, which is why we’re a certified B Corporation and donate 10% of our profits to charity.
We strive to build teams that reflect the diversity of the communities we work in. We encourage all qualified applicants to apply, including people from traditionally underrepresented groups such as women, visible minorities, Indigenous peoples, people identifying as LGBTQ2SI, veterans, and people with visible/nonvisible disabilities.
We have a dedicated webpage for accommodations where you can learn more about what we offer and request accommodation: https://raise.jobs/accommodations/
In order to submit candidates for roles, our clients will sometimes require personal information to confirm the identity of applicants and their legal status to work. Raise will never ask you for personal or banking information unless you have been selected for a job. If you are ever unsure about the legitimacy of this or any other Raise job posting (or have any other questions), please contact us at +1 800-567-9675 or hello@raiserecruiting.com.
#WES
#LI-SC1
