{"id":20283,"url":"https://alion.io/job/blackducksoftware-threat-intelligence-engineer","title":"Threat Intelligence Engineer","company":{"id":720312,"name":"Black Duck","domain":"blackduck.com","url":"https://alion.io/company/blackduck","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":89,"open_postings":4,"ghost_share":0,"stale_share":0.25,"repost_share":0,"time_to_fill_p50_days":79,"computed_at":"2026-09-29T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Belfast, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":37000,"max_usd":105000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":309},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DLP","optional":false},{"name":"npm","optional":false},{"name":"Recorded Future","optional":false},{"name":"SIEM","optional":false},{"name":"STIX","optional":false},{"name":"Sumo Logic","optional":false},{"name":"JavaScript","optional":true}],"status":"live","first_seen_at":"2026-07-17T08:13:28Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-09-30T00:52:19Z","board_verified":true,"closed_at":null,"days_open":74,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":74},"description":"Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle.\nThe Threat Intelligence Engineer supports the research, collection, and analysis of threat data that enables Black Duck to detect and respond to threats targeting the enterprise and its software supply chain. Working within the Threat Intelligence function under moderate supervision, you apply foundational knowledge of adversary tradecraft to assist in producing intelligence products, maintaining indicator pipelines, and contributing threat context to security workflows across the organization. This role solves moderately complex problems within defined guidelines and policies, collaborates with senior engineers on intelligence operations, and supports broader cybersecurity and security operations functions as capacity allows.\nEssential Functions/Responsibilities\nAssist with collection, processing, and analysis tasks across the intelligence requirements-to-dissemination workflow.\nHelp maintain the intelligence requirements register under guidance from senior team members.\nDraft threat actor profiles, campaign summaries, and indicator packages for technical audiences; refine products based on senior engineer feedback.\nIngest, validate, and score indicators of compromise (IOCs) from commercial feeds (e.g., Recorded Future), open-source, and internal sources.\nSupport integration of IOC pipelines with SIEM and EDR platforms, including Sumo Logic and CrowdStrike Falcon/NG SIEM.\nApply confidence scoring and structured formats (e.g., STIX 2.1) to intelligence artifacts; escalate data quality issues to senior team members.\nMonitor open-source package registries (npm, PyPI, Go, Maven, and others) and CI/CD pipeline integrity signals for indicators of adversarial activity including typosquatting, dependency confusion, and build-pipeline compromise.\nContribute to the internal supply chain threat detection program by assisting with data collection, documentation, and detection logic testing.\nAssist broader cybersecurity and security operations functions - including CSIRT, Vulnerability Management, and PSIRT - with alert triage, threat research, and DLP investigation enrichment, as capacity allows.\nSupport security investigations by researching threat actor behaviors, identifying relevant IOCs, and providing contextual summaries.\nPrepare threat intelligence summaries and briefing materials for internal consumers including CSIRT and Vulnerability Management.\nIdentify opportunities for workflow improvements within own area and recommend changes to senior team members.\nLearn and follow applicable standards for intelligence data handling, sharing agreements, and governance; contribute to supporting documentation as directed.\nOther tasks and activities as assigned.\nRequired Education/Experience & Skills\n\nTypically at least two (2) years of experience in threat intelligence, security operations, threat hunting, or a closely related cybersecurity role; demonstrated ability to solve moderately complex problems within established guidelines.\nWorking familiarity with the intelligence production lifecycle, threat actor profiling concepts, and structured formats (e.g., STIX 2.1); ability to apply MITRE ATT&CK for basic TTP mapping.\nPractical experience working within enterprise SIEM or EDR environments; ability to run queries, review alerts, and support detection validation (current platforms include Sumo Logic and CrowdStrike Falcon/NG SIEM).\nConceptual understanding of adversarial techniques targeting open-source ecosystems - including typosquatting, dependency confusion, registry abuse, and build-pipeline compromise - and the ability to identify relevant indicators.\nStrong written and verbal English communication skills; able to explain moderately complex threat information clearly to peers and adjacent teams; comfortable escalating appropriately under moderate supervision.\nBachelor's degree in computer science, information security, or a related field preferred; entry-level security certified\nBlack Duck is an equal opportunity employer. We consider all applicants for employment without regard to race, color, national origin, religion, sex, gender identity or expression, age, disability, sexual orientation, veteran or military service status, or any other characteristic protected by applicable law. Black Duck complies with all applicable laws prohibiting employment discrimination in every jurisdiction where it operates and provides reasonable accommodations to individuals with disabilities in accordance with applicable law.","description_format":"text","description_chars":5066,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Cybersecurity","DevSecOps"],"lifecycle":[{"event":"open","at":"2026-07-17T08:13:28Z"}],"liveness":{"score":49,"band":"ok","label":"Likely open","p_open":1,"p_active":0.814,"p_room":0.6,"age_days":73,"expected_fill_days":79,"reasons":["conf:1","velocity","win:late","crowd:junior"],"computed_at":"2026-09-29T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/blackducksoftware-threat-intelligence-engineer","json_url":"https://alion.io/job/blackducksoftware-threat-intelligence-engineer.json","meta":{"generated_at":"2026-09-30T01:42:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":1296,"day_limit":5000,"remaining_today":3704,"minute_limit":60,"resets_at":"2026-10-01T00:00:00Z"}}}