TS/SCI Principal Cyber Intelligence Engineer

The Mitre Corporation•Huntsville, AL

6d•$172,800 - $259,200•Onsite

About The Position

MITRE’s Cyber Threat Intelligence department is seeking a Principal Cyber Intelligence Engineer to advance cyber intelligence research and innovation in support of government and private-sector sponsors. The role leads projects and tasks and collaborates across MITRE, government, industry, and academia to help address complex national and global challenges. The engineer applies cyber intelligence expertise to sponsor missions, including defensive cyber operations, weapons-system security, critical-infrastructure threat assessment, and analysis of intelligence reporting to enable cyber effects. The role advises sponsors on how cyber intelligence supports their missions and security organizations, helps build and advance cyber intelligence capabilities and programs, evaluates tools and recommends analytic methods and AI integration, and proposes and performs research and development. The position also applies and contributes to MITRE ATT&CK® and demonstrates technical threat analysis across intrusion and malware analysis, threat actor profiling, infrastructure analysis, and adversary campaign tracking. The engineer evaluates CTI tools, platforms, data sources, automation, and emerging technologies—including AI and machine learning—to improve intelligence collection, analysis, correlation, and dissemination, and develops approaches for integrating CTI with threat hunting, detection engineering, incident response, vulnerability management, and cyber risk analysis. The position requires an active Top Secret/SCI U.S. Government-issued clearance and at least four days per week onsite.

Requirements

Typically, at least 10 years of related experience with a bachelor’s degree, 8 years with a master’s degree, or 5 years with a Ph.D.; an equivalent combination of related education and work experience is also accepted.
Knowledge of adversary tradecraft and the use of cyber operations as a tool of military force and statecraft.
Experience with U.S. government cybersecurity agencies, intelligence agencies, authorities, and relationships.
Strong leadership and communication skills to mentor teams and collaborate with diverse internal and external stakeholders.
Demonstrated application of MITRE ATT&CK® in operational environments and experience with structured frameworks and analytic techniques such as the Diamond Model.
Familiarity with all-source intelligence databases and analytic tools.
Active Top Secret/SCI U.S. Government-issued security clearance; must be a U.S. citizen to be eligible for a security clearance.
Ability to work onsite at least four days per week.

Nice To Haves

Experience building and managing CTI teams and overseeing strategic, operational, and tactical products and services.
Experience with Threat Intelligence Platforms (TIPs), including configuring them to stakeholder requirements.
Hands-on technical expertise in adversary emulation, defensive cyber operations, cyber analytics and malware analysis, cyber deception and adversary engagement, cyber effects and reverse engineering, or cyber forensics.
Familiarity with adversarial command-and-control hardware and software.
Familiarity with basic, intermediate, and advanced target development.
Familiarity with vulnerability identification.
Familiarity with network architecture analysis.
Advanced knowledge of MITRE ATT&CK® and adversary behavioral analysis.
Experience integrating CTI with threat hunting, detection engineering, and incident response.

Responsibilities

Apply cyber intelligence expertise to help sponsors address challenges involving defensive cyber operations, weapons-system security, critical infrastructure, and intelligence analysis supporting cyber effects.
Help sponsors understand how cyber intelligence supports their organizational missions and security functions.
Guide sponsors in building and advancing cyber intelligence capabilities and programs.
Review sponsor tools and recommend best practices, analytic methodologies, and opportunities to integrate AI.
Propose and perform research and development to advance cyber intelligence.
Use or contribute to MITRE ATT&CK® to help the cybersecurity community understand threat behaviors.
Conduct technical threat analysis, including intrusion analysis, malware analysis, threat actor profiling, infrastructure analysis, and adversary campaign tracking.
Evaluate and apply CTI tools, platforms, data sources, automation, and emerging technologies, including AI and machine learning, to improve intelligence collection, analysis, correlation, and dissemination.
Develop approaches for integrating cyber threat intelligence with threat hunting, detection engineering, incident response, vulnerability management, and cyber risk analysis.
Lead projects and tasks and collaborate across MITRE and with government, industry, and academia.