Cyber Threat Engineer

Job ID: JP00017912
Department: Non-Digital
Location: Hybrid – Vienna, VA or Pensacola, FL
Experience Level: 5–10 Years
Requirement Release Date: 11/03/2026
Positions: 1
Slots: 3

Work Authorization: Please confirm that the candidate is legally authorized to work in the United States.

Compensation:

• Vienna, VA: $127K + Benefits | $70/hr W2 (All Inclusive) | $77/hr Corp-to-Corp

• Pensacola, FL: $110K + Benefits | $61/hr W2 (All Inclusive) | $68/hr Corp-to-Corp

Position Summary

The Cyber Threat Engineer is a mid-level cybersecurity engineering role responsible for developing and maintaining the tools, automation, integrations, and technical processes that support threat intelligence and threat-hunting activities. Working from requirements defined by the threat team, the engineer will independently design, test, document, and maintain reusable technical solutions. The position enables threat analysis and hunting through engineering rather than serving as the primary threat analyst.

Key Responsibilities

• Develop and maintain tools, scripts, and automated workflows that support threat-hunting and intelligence operations.

• Build repeatable processes for collecting, ingesting, enriching, transforming, and operationalizing threat intelligence data.

• Develop, test, document, and maintain YARA rules and supporting detection processes.

• Create Python-based utilities and script automation to reduce manual effort and improve workflow scalability.

• Translate analyst requirements into technical solutions, integrations, automated processes, and reusable capabilities.

• Apply the MITRE ATT&CK framework when developing threat-hunting tools, detections, and supporting processes.

• Integrate internal and external threat intelligence sources into threat team workflows and supporting tools.

• Validate and perform quality assurance for tools, scripts, rules, integrations, and automation before operational use.

• Troubleshoot and maintain threat team tools, data pipelines, integrations, and automated workflows.

• Maintain technical documentation and procedures needed to sustain developed capabilities.

Preferred Qualifications

• Bachelor's degree in cybersecurity, computer science, information technology, information systems, engineering, or a related technical discipline preferred; relevant experience may be considered in lieu of a degree.

• Master's degree in cybersecurity, information assurance, computer science, or a comparable technical discipline strongly preferred; comparable advanced technical qualifications or demonstrated expertise may be considered.

• Demonstrated experience in cybersecurity engineering, security automation, or threat engineering.

• Direct experience supporting Cyber Threat Intelligence or threat-hunting functions required.

• Demonstrated experience with Python (3+ years), script-based automation, and YARA and SIGMA rule development.

• Practical experience applying the MITRE ATT&CK framework to cybersecurity or threat-hunting use cases.

• Security+, CySA+, GCIH, GCIA, or comparable cybersecurity certifications preferred, but not required.

Key Skills

• Strong cybersecurity engineering, automation, troubleshooting, and technical problem-solving skills.

• Ability to translate analyst requirements into reliable, reusable, and maintainable technical solutions.

• Ability to independently develop, test, document, and maintain scripts, integrations, automation, and supporting processes.

• Understanding of threat intelligence and threat-hunting concepts and workflows.

• Effective communication and collaboration with threat analysts and defensive cybersecurity partners.

• Strong attention to quality, repeatability, maintainability, and documentation.

Expected Contribution

This position will provide dedicated engineering support for core threat intelligence and threat-hunting functions rather than primary ownership of threat analysis. The engineer will convert analyst requirements into scalable tools, rules, integrations, and automated processes that improve operational efficiency and consistency. This capacity will reduce the technical workload carried by threat analysts and support the continued expansion of threat-hunting capabilities.