Staff Security Engineer, Threat Intelligence

Nscale•Seattle, WA

1d•$190,000 - $225,000•Remote

About The Position

Nscale is seeking a Staff Security Engineer, Threat Intelligence to build and scale the company's threat intelligence capability. This high-impact, engineering-driven role focuses on connecting external threat intelligence with internal telemetry to improve the company's detection and response capabilities. The role collaborates with Detection & Response and supports security efforts across infrastructure, cloud, and enterprise systems. The engineer will strengthen Nscale's security posture by tracking threat actors, campaigns, and emerging techniques, and translating this intelligence into practical detections, defenses, and response improvements. This role is part of the global Cyber Defense organization.

Requirements

8+ years of experience in threat intelligence, security engineering, or detection engineering
Strong understanding of threat actors, tactics, techniques, and procedures (TTPs)
Experience translating intelligence into detections, rules, or security controls
Familiarity with SIEM platforms and detection pipelines
Experience with threat intelligence platforms (TIPs) and data formats such as STIX/TAXII
Understanding of cloud environments and modern infrastructure
Experience leveraging automation or AI/ML techniques for intelligence analysis or enrichment
Ability to operate at a Staff level, driving strategy, influencing detection programs, and owning systems
Clear communication skills with the ability to share insights and risks with technical teams and leadership

Nice To Haves

experience in AI infrastructure
threat hunting
incident response
SOAR integrations
malware analysis
advanced threat actor tracking

Responsibilities

Track relevant threat actors, campaigns, and emerging attack techniques tied to Nscale’s environment
Analyze adversary tactics, techniques, and procedures to identify meaningful security implications
Produce actionable threat intelligence tailored to infrastructure, cloud, and enterprise systems
Evaluate external intelligence sources, feeds, and tooling for relevance and quality
Translate intelligence into detection logic, SIEM rules, and security controls
Partner with Detection & Response to improve coverage against known adversary behaviors
Maintain mappings to frameworks such as MITRE ATT&CK and identify coverage gaps
Improve defensive visibility by aligning detections to current and emerging threats
Integrate threat intelligence into SIEM pipelines, enrichment systems, and automation workflows
Leverage AI and automation to process large volumes of threat data and surface patterns
Support the use of intelligence data within operational security systems and workflows
Support incident response and threat hunting with contextual intelligence and hypothesis generation
Communicate insights, risks, and adversary activity clearly to technical teams and leadership
Enable more effective response playbooks by embedding intelligence into response workflows