Security Engineer 2 - Cyber Threat Intelligence

What You’ll Do

• Develop and maintain tooling that automates the collection, processing, analysis, and dissemination of threat intelligence.
• Assess emerging vulnerabilities, threat activity, and security events to help stakeholders understand potential impact to Datadog.
• Conduct threat hunting and infrastructure analysis to identify adversary activity relevant to Datadog and improve defensive controls.
• Partner with security teams to operationalize intelligence into detections, investigations, and response workflows.
• Coordinate with information-sharing communities to gather, evaluate, and disseminate actionable intelligence.
• Produce technical briefings, threat reports, and intelligence products for security and engineering stakeholders.

Who You Are

• Experienced in writing and presenting operational and technical intelligence for threat detection, response, and security stakeholders.
• Skilled in partnering with detection and response teams to support investigations, improve response playbooks, and prioritize detection opportunities based on adversary tactics, techniques, and procedures (TTPs).
• Familiar with information-sharing communities and able to apply sound judgment when handling and operationalizing TLP-designated intelligence.
• Experienced in identifying and responding to large-scale emerging threats, including supply chain compromises, industry-wide campaigns, and exploitation of newly disclosed vulnerabilities.
• Experienced in dynamic/static analysis of Linux and MacOS malware and in tracking cloud-native cybercrime and nation-state threat actors.
• Proficient in developing threat intelligence tooling and automation through software development and scripting.

Nice to Have

• Experience presenting at security conferences and publishing threat research.
• Experience with malware reverse engineering.