Senior Director, Threat Intelligence

As the leading independent provider of risk and financial advisory solutions, Kroll leverages our unique insights, data, and technology to help clients stay ahead of complex cyber threats. Our Cyber Risk team partners with organizations around the world to deliver intelligence-driven security solutions that enable informed decision-making and proactive risk management.

We are seeking an experienced Threat Intelligence Platform Engineer to join our Cyber Threat Intelligence team. This role is ideal for a security professional who is passionate about engineering scalable threat intelligence capabilities through automation, data integration, and platform management.

The Intelligence Platform Engineer is responsible for designing, building, and maintaining the technology, automation, and data infrastructure that powers cyber threat intelligence operations. This role serves as the bridge between intelligence analysis, threat research, data engineering, and security operations by developing scalable solutions that automate the collection, enrichment, normalization, correlation, and dissemination of cyber threat intelligence.

The successful candidate will identify and integrate intelligence data sources from commercial providers, open-source intelligence (OSINT), internal security telemetry, dark web collections, government feeds, and industry-sharing communities. They will leverage automation, APIs, machine learning, and data engineering techniques to transform raw intelligence into actionable insights that support threat detection, incident response, vulnerability management, executive reporting, and strategic decision-making. This aligns with internal descriptions emphasizing ownership of a threat intelligence platform, automation, and multi-source intelligence integration.

Working closely with Threat Intelligence Analysts, Incident Responders, Detection Engineers, and Security Operations teams, the successful candidate will improve the organization's ability to identify emerging threats through intelligent automation and data engineering.

Key Responsibilities:

• Administer, maintain, and optimize Kroll’s Threat Intelligence Platform.

• Design and develop automated workflows for collecting, enriching, correlating, and distributing cyber threat intelligence.

• Build scalable automation to support dark web monitoring, credential exposure tracking, threat actor activity, and emerging threat detection.

• Develop and maintain integrations with commercial threat intelligence providers, OSINT sources, government intelligence feeds, ISACs, and internal security platforms.

• Design ETL pipelines to ingest, normalize, and organize structured and unstructured threat intelligence datasets.

• Correlate indicators of compromise (IOCs), threat actors, malware families, vulnerabilities, and campaigns using industry standards such as STIX/TAXII and the MITRE ATT&CK Framework.

• Develop dashboards, reporting, and visualizations that improve analyst efficiency and provide actionable intelligence to stakeholders.

• Evaluate emerging technologies, intelligence sources, and AI-driven capabilities to continuously improve Kroll's threat intelligence operations.

• Ensure data quality, governance, and security across all intelligence repositories.

Required Qualifications:

Education

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related discipline, or equivalent professional experience.

Experience

• Minimum of five (5) years of experience in cybersecurity, cyber threat intelligence, or security engineering.

• Experience administering a Threat Intelligence Platform (EclecticIQ strongly preferred).

• Proven experience designing automation solutions using Python.

• Experience integrating APIs and external data sources.

• Hands-on experience with cyber threat intelligence workflows and intelligence lifecycle management.

Technical Qualifications

Threat Intelligence

• Experience working Threat Intelligence Platforms

• STIX 2.x and TAXII

• MITRE ATT&CK Framework

• MISP (preferred)

• IOC lifecycle management

• Threat actor tracking

• Campaign analysis

• Malware intelligence

• TTP analysis

Programming & Automation

Required:

• Advanced Python development

Experience with:

• REST APIs

• Webhooks

• Async programming

• Requests

• Pandas

• BeautifulSoup

• Selenium or Playwright

• SQLAlchemy

Preferred:

• JavaScript

• PowerShell

• Go

Data Engineering

Experience with:

• SQL

• PostgreSQL

• Elasticsearch/OpenSearch

• MongoDB (preferred)

Ability to:

• Build ETL pipelines

• Normalize structured and unstructured datasets

• Correlate multiple intelligence sources

• Design scalable data ingestion workflows

Dark Web Intelligence

Experience collecting and automating intelligence from:

• Underground forums

• Telegram channels

• Credential leak repositories

• Marketplace monitoring

• Paste sites

• Open-source intelligence sources

Cloud & Infrastructure

Experience with AWS services including:

• Lambda

• ECS

• S3

• IAM

• EventBridge

• Step Functions

• Secrets Manager

Security Platforms

Experience integrating with technologies such as:

• Splunk

• CrowdStrike Falcon

• VirusTotal

• GreyNoise

• Shodan

• Censys

Preferred Qualifications

• Experience developing AI-assisted threat intelligence workflows.

• Familiarity with Large Language Models (LLMs) for intelligence summarization and analysis.

• Experience with graph databases such as Neo4j.

• Knowledge of Retrieval-Augmented Generation (RAG) architectures.

• Experience building knowledge graphs.

• Familiarity with DevOps practices, Docker, Kubernetes, and CI/CD pipelines.

Preferred Certifications

• GIAC Cyber Threat Intelligence (GCTI)

• SANS FOR578 Cyber Threat Intelligence

• CISSP

• AWS Certified Security – Specialty

• AWS Certified Developer – Associate

• Security+

• GSEC

What Success Looks Like

The successful candidate will:

• Build scalable automation that significantly reduces manual intelligence collection and analysis.

• Improve analyst productivity through efficient data integration and workflow automation.

• Expand Kroll's ability to monitor the dark web and emerging threat landscape.

• Deliver actionable, high-quality intelligence through a modern, integrated Threat Intelligence Platform.

• Help position Kroll as an industry leader in intelligence-driven cybersecurity services through continuous innovation and operational excellence.

Why Join Kroll?

At Kroll, you'll work alongside some of the industry's most respected cyber professionals, solving complex challenges for organizations around the world. We foster a collaborative, innovation-driven environment where your expertise directly contributes to protecting clients from evolving cyber threats. You'll have the opportunity to work with cutting-edge technologies, influence the evolution of our threat intelligence capabilities, and make a meaningful impact across our global Cyber Risk practice.

• Healthcare Coverage: Comprehensive medical, dental, and vision plans.

• Time Off and Leave Policies: Generous paid time off (PTO), paid company holidays, generous parental and family leave.

• Protective Insurances: Life insurance, short- and long-term disability coverage, and accident protection.

• Compensation and Rewards: Competitive salary structures, performance-based incentives, and merit-based compensation reviews.

• Retirement Plans: 401(k) plans with company matching.

Please note that benefits may vary by region, department and role. We encourage you to speak with your recruiter to learn more about the specific benefits available for your position.

About Kroll

Join the global leader in risk and financial advisory solutions—Kroll. With a nearly century-long legacy, we blend trusted expertise with cutting-edge technology to navigate and redefine industry complexities. As a part of One Team, One Kroll, you'll contribute to a collaborative and empowering environment, propelling your career to new heights. Ready to build, protect, restore and maximize our clients’ value? Your journey begins with Kroll.

We are proud to be an equal opportunity employer and will consider all qualified applicants regardless of gender, gender identity, race, religion, color, nationality, ethnic origin, sexual orientation, marital status, veteran status, age or disability.

#LI-CN1

#LI-Remote