Specialist, Threat Intelligence Development & Automations

Job ID: 33847

Location: Warszawa, PL

Area of interest: Technology

Job type: Regular Employee

Work style: Hybrid Working

Opening date: 21 Jul 2025

• Writing code, mostly in Python and Synapse Storm to automate Cyber Threat Intelligence (CTI) processes and tools to collect, process and facilitate analysis of threat information.
• Maintaining and developing the process for Threat data feeds ingestion and Indicators of Compromise (IOCs) enrichment, normalisation, and curation.
• Developing a range of connectors to interact with third party APIs to collect and process data for Synapse Threat Intelligence Platform (Vertex Project).
• Developing custom API endpoints to enable automated ingestion of structured threat information by internal security & business systems.
• Supporting the creation, deployment, testing and maintenance of custom and commercial CTI services, tools and systems.
• Developing and maintaining existing automations for adversary networks discovery and tracking.
• Building and maintaining malware processing pipeline for multiple malware detection and analysis systems.
• Contributing to Cyber Threat Intelligence processes committed to continually mature and improve adversary hunting skills.

• Have Python language developer skills and experience in developing API integrations for data processing pipelines.
• Min. 4 years of experience in developing systems and platforms, preferably for cybersecurity purposes.
• Have experience in automating tasks and workflows, preferably AWS automation experience.
• Know how to automate and orchestrate tasks, preferably with Terraform.
• Understand container technologies (docker, Kubernetes) and you are familiar with cloud infrastructure deployments (AWS, EKS).
• Have passion for building adversary hunting capabilities and helping cyber security teams to impose cost on adversary operations.
• Positive, can-do attitude with a strong willingness to contribute, grow, and take ownership of tasks.
• Good communication and relationship-building skills to support effective stakeholder management.
• Interest in Cyber Threat Intelligence.
• Familiarity with Cyber Threat Intelligence open-source projects such as Synapse, MISP, OpenCTI.
• Familiarity with Cyber Threat Intelligence tools and sources such as Shodan, Censys, VirusTotal, pDNS, netflows.
• Experience with Azure DevOps.
• Malware analysis and YARA rules development experience (nice to have).

• Do the right thing and are assertive, challenge one another, and live with integrity, while putting the client at the heart of what we do
• Never settle, continuously striving to improve and innovate, keeping things simple and learning from doing well, and not so well
• Are better together, we can be ourselves, be inclusive, see more good in others, and work collectively to build for the long term

• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.
• Flexible working options based around home and office locations, with flexible working patterns.
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global Employee Assistance Programme, sick leave, mental health first-aiders and all sorts of self-help toolkits
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual and digital learning.
• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions and geographies - everyone feels respected and can realise their full potential.