{"id":1762273,"url":"https://alion.io/job/clio-lead-threat-intelligence-engineer","title":"Lead Threat Intelligence Engineer","company":{"id":5273,"name":"Clio","domain":"clio.com","url":"https://alion.io/company/clio","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Vancouver, Canada","Toronto, Canada","Calgary, Canada","Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":97000,"max_usd":251000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Diamond Model","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OpenSearch","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Ruby","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-10-02T00:00:00Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-05T00:20:22Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely.\nWe are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice.\nSummary:\nThe Role\nClio is looking to build a dedicated threat intelligence capability. Today, adversary tracking, fraud pattern analysis, and abuse intelligence happen informally across a few teams. This role makes threat intelligence a standing discipline: characterize who is targeting Clio and organizations like it, what they're using, and turn that into work other teams can act on.\nThis is a senior individual-contributor role, where you'll be expected to establish and formalize how Clio tracks adversaries. This is the first hire in a function Clio intends to grow - the practices you establish become the foundation the rest of the team is built on.\nYou will work closely with Clio's internal red team and detection engineer. Threat Intelligence characterizes the adversary - who they are, how they operate, what to watch for. The Red Team takes your prioritized, evidence-backed picture of the threat and decides what to simulate and attack; the detection engineer turns the same picture into detection logic in our SIEM. As the detection platform matures, your intelligence requirements shape what gets built.\nWhat We're Protecting Firms From\nClio has nearly every piece of data you can conceive: privileged litigation strategy, M&A documents, and trust accounts that can get a lawyer disbarred if they're not protected properly! The Panama Papers breach showed the stakes - 11.5 million client documents left Mossack Fonseca, and the firm shut down two years later. The legal field is rife with examples where security must be taken seriously:\nSilent Ransom Group (Luna Moth) has extorted more than 100 US law firms since 2023, using IT-themed vishing calls and, recently, operatives who walk into firm offices posing as IT technicians (FBI advisories, 2025 and 2026)\nINC Ransom claimed 20 legal-sector victims in 2026, ten of them inside a single 48-hour window\nChinese state actors breached Williams & Connolly and Wiley Rein to reach trade, sanctions, and M&A matters; Mandiant estimates 80 of the 100 largest US firms have been hacked since 2011\nMost of Clio's customers are solo, small, and mid-size firms - the segment with the highest breach rate (ABA 2025 data) and the least in-house security. At the same time some of the largest legal organizations, including governments, rely on Clio. When you characterize an adversary, you protect tens of thousands of firms that cannot do this work themselves!\nAI Is the Expectation:\nClio's security team works with AI every day, and this role is built on that assumption. You'll use AI agents to scale collection, enrichment, triage, and first-draft reporting - and apply your own judgment to everything they produce. The adversary side is part of your beat too: AI-enabled tradecraft belongs in the landscape you cover. If the idea of directing a fleet of agents sounds like how intelligence work should be done, you'll fit perfectly at Clio.\nA Day in the Life\nDigging through raw infrastructure data to attribute a phishing kit to a known actor before any vendor report names them\nBriefing security leadership team on a geopolitical or sector-specific threat trend relevant to legal tech\nWriting fraud pattern briefs from account-abuse signals and handing the Trust (anti-abuse) function specific patterns to detect\nWorking with our payment operations group to identify fraud patterns and rings within Clio Payments\nMentoring newer analysts on how to separate a credible early indicator from noise\nProposing a new data source or tracking method because the current one is missing a class of activity\nWhat You'll Do\nBuilding the program\nDefine and maintain Clio's Priority Intelligence Requirements with stakeholders across Security, Trust, Payments, and leadership, then run the full intelligence lifecycle against them - from requirements through dissemination and feedback\nStand up Clio's threat intelligence platform and make it the system of record for tracked actors, campaigns, and indicators\nShape vendor purchases and tooling rollouts - OSINT and dark-web monitoring, feeds, enrichment - as the program's collection needs take form\nMeasure whether intelligence changes outcomes: detection coverage in the SIEM (Splunk, ELK/OpenSearch), Red Team campaign success grounded in your reporting, and time-to-detect on incidents with prior intel coverage\nIntelligence production\nTrack external threat actors, techniques, and infrastructure relevant to legal tech and Clio's customer base\nProduce intelligence at three tiers: tactical indicators and TTPs for detection, operational campaign briefs for security leadership, and strategic landscape assessments for executives\nEstablish and refine Clio's methodology for tracking adversary campaigns, rather than running someone else's playbook\nProduce original research: infrastructure hunting from raw data, malware and campaign attribution\nAnalyze fraud and abuse patterns and insider-threat signals, and turn them into briefs the Trust (anti-abuse) function can act on\nTrack BEC and trust-account wire-fraud tradecraft targeting law firms, and feed it into fraud detection for Clio Payments\nAssess coordinated disclosure and patch-storm events for real exploitation urgency\nFeeding other teams\nHand Red Team a prioritized, evidence-backed list of techniques worth simulating\nHand our detection engineer intel-backed detection requirements\nBrief security leadership directly, in addition to the SOC and engineering teams\nAlert Payment Operations of external signals: tracked actors, fraud rings, known malicious domains/IPs, etc. to filter fraud from our payments business before they can act\nExternal relationships\nManage commercial threat-intel feed vendors and evaluate new ones against cost and signal quality\nParticipate in industry intel-sharing groups and represent Clio in those relationships\nCollaborate and code with the blue team on defensive remediations\nWhat You Bring\n5+ years in threat intelligence or a closely adjacent function, with original research you can point to\nExperience establishing or scaling a security function/team from the ground up, not just operating inside an existing one. Self-starter.\nScripting ability (Ruby, Python, or similar) for building, upgrading, and maintaining automation\nFluency with MITRE ATT&CK, the Diamond Model, and structured analytic techniques such as Analysis of Competing Hypotheses, applied in your own analysis\nTrack record of establishing or materially improving a tracking methodology someone else now uses\nComfort briefing both technical teams and director+ level, and adjusting the message for each\nAbility to turn raw intelligence into a specific, actionable ask for another team - a detection to write, a technique to simulate, a vendor risk to flag\nFluency with AI tooling in analytical work - agents for collection, enrichment, and drafting - and the judgment to validate what they produce\nExperience mentoring more junior analysts\nBonus Points\nExisting relationships in industry intel-sharing communities\nExperience with fraud or insider-threat analysis in addition to external threat tracking, or financial services cybercrime experience\nFamiliarity with the legal-tech or professional-services threat landscape, or ability to build that context quickly\nThis role is a backfill for an existing position.What you will find here:\nCompensation is one of the main components of Clio’s Total Rewards Program. We have developed a series of programs and processes to ensure we are creating fair and competitive pay practices that form the foundation of our human and high-performing culture.\nSome highlights of our Total Rewards program include:\nCompetitive, equitable salary with top-tier health benefits, dental, and vision insurance\n\nHybrid work environment, with expectation for local Clions (Vancouver, Calgary, Toronto, Dublin, London, New York City and Sydney) to be in office min. twice per week.\n\nFlexible time off policy, with an encouraged 20 days off per year.\n\n$2000 annual counseling benefit\n\nRRSP matching and RESP contribution\n\nClioversary recognition program with special acknowledgement at 3, 5, 7, and 10 years\n\nThe expected salary range for this role is $157,300 to $212,800 CAD. Initial placement within the range is informed by geographic region, experience, and skillset, with room to progress as impact and tenure grow. Final offer amounts will vary based on candidate profile.Diversity, Inclusion, Belonging and Equity (DIBE) & Accessibility\nOur team shows up as their authentic selves, and are united by our mission. We are dedicated todiversity, equity and inclusion. We pride ourselves in building and fostering an environment where our teams feel included, valued, and enabled to do the best work of their careers, wherever they choose to log in from. We believe that different perspectives, skills, backgrounds, and experiences result in higher-performing teams and better innovation. We are committed to equal employment and we encourage candidates from all backgrounds to apply.\nClio provides accessibility accommodations during the recruitment process. Should you require any accommodation, please let us know and we will work with you to meet your needs.\nLearn more about our culture atclio.com/careers\nWe're a Human and High Performing AI company, meaning we use artificial intelligence to improve all of our operations. In recruitment, AI helps us streamline the process for greater efficiency. However, we've built our systems to ensure that a human always reviews AI-generated output, and we never make automated hiring decisions.\nDisclaimer: We only communicate with candidates through official @clio.com email addresses.","description_format":"text","description_chars":9922,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible time off","Hybrid work","Vision insurance"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Legal Software"],"lifecycle":[{"event":"open","at":"2026-10-03T13:09:07Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":31,"reasons":["conf:2","velocity","win:early","comp:brand"],"computed_at":"2026-10-04T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/clio-lead-threat-intelligence-engineer","json_url":"https://alion.io/job/clio-lead-threat-intelligence-engineer.json","meta":{"generated_at":"2026-10-05T03:10:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":4321,"day_limit":5000,"remaining_today":679,"minute_limit":60,"resets_at":"2026-10-06T00:00:00Z"}}}