Threat Intelligence Engineer_3377

Required:

• Experience in threat intelligence, threat monitoring, or SOC/CTI operations – you have kept watch over real environments and know what a meaningful signal looks like
• Solid grounding in the Threat Intelligence Lifecycle and structured analytical techniques, and frameworks such as the Diamond Model, Kill Chain, and MITRE ATT&CK
• Ability to produce clear, accurate analytical products and communicate them to audiences of varying technical depth, with excellent English language skills
• Hands-on technical ability – Python or scripting, API integrations, and lightweight workflow building; you build tools, not only use them
• Working knowledge of detection logic and telemetry – you can read, reason about, and contribute to detection rules and hunting leads
• Experience with at least one Threat Intelligence Platform, ideally Google Threat Intelligence / VirusTotal, CrowdStrike Intelligence, or Recorded Future
• An AI-native working style – you integrate LLMs and automation tools into your daily monitoring, enrichment, and analytical workflow
• Composure under pressure – you deliver clearly and effectively during incidents and time-critical escalations

Preferred:

• Background in Incident Response, SOC operations, or digital forensics
• Hands-on detection engineering experience, ideally authoring rules in Google SecOps or CrowdStrike
• Prior experience in IT administration (server, network, endpoint) – understanding what you are defending at infrastructure level
• SANS FOR578 (Cyber Threat Intelligence) or equivalent certification
• Familiarity with threat sharing platforms (MISP) and large-scale IOC management
• Experience with SOAR platforms, N8N, or Power Automate
• Data and Process visualization proficiency (Grafana, advanced Excel, PowerPoint)
• Certifications: GIAC (GCTI, GCIH, GCFA), CISSP, or OSCP

Who You Are

• A bridge-builder — you are equally comfortable with an analyst’s judgment and an engineer’s toolkit, and you connect the two without friction
• Vigilant and curious — you notice what others scroll past, and you follow a faint signal until you know what it means
• A builder — you identify gaps and close them without waiting for instruction
• Autonomous and outcome-driven — you execute decisively, follow guidelines, and report after; action precedes permission
• A communicator — you understand that ultimately people execute defenses, and people must understand what you produce
• Energized by transformation — an unfinished environment is an opportunity, not a problem
• Process-aware without being process-bound — you operate with discipline, can justify your decisions under scrutiny, but never let procedure prevent progress
• Collaborative across boundaries — in our pooled model, you will work across squads (Monitoring, Intrusion Analysis, TTP & Threat Actor Analysis, IOC Handling) and partner daily with detection engineers and incident responders
• Exposure in AI ,GenAI and Agentic AI preffered.

Allianz Group is one of the most trusted insurance and asset management companies in the world. Caring for our employees, their ambitions, dreams and challenges, is what makes us a unique employer. Together we can build an environment where everyone feels empowered and has the confidence to explore, to grow and to shape a better future for our customers and the world around us. 

At Allianz, we stand for unity: we believe that a united world is a more prosperous world, and we are dedicated to consistently advocating for equal opportunities for all. And the foundation for this is our inclusive workplace, where people and performance both matter, and nurtures a culture grounded in integrity, fairness, inclusion and trust. 

We therefore welcome applications regardless of ethnicity or cultural background, age, gender, nationality, religion, social class, disability or sexual orientation, or any other characteristics protected under applicable local laws and regulations. 

Great to have you on board. Let's care for tomorrow.