Senior MISP Integration Engineer – Cyber Threat Intelligence

We are seeking a highly experienced Senior MISP Integration Engineer to support the modernization and integration of a Cyber Threat Intelligence (CTI) capability within a multinational defense environment.

The successful candidate will bring deep hands-on expertise in the Malware Information Sharing Platform (MISP), threat intelligence automation, API integrations, intelligence enrichment, and secure information-sharing workflows.

This role is suited to an engineer who has deployed, configured, integrated, and maintained MISP in production environments and understands how threat intelligence supports real-world security operations.

Key Responsibilities

Assess, configure, enhance, and integrate existing MISP instances within enterprise cybersecurity environments.

Design and implement MISP integrations with SIEM, EDR, threat intelligence feeds, vulnerability management, and other cybersecurity platforms.

Develop and maintain integrations using PyMISP, REST APIs, Python, and supported intelligence exchange mechanisms.

Implement automated intelligence collection, enrichment, normalization, deduplication, correlation, and distribution workflows.

Configure MISP taxonomies, galaxies, warning lists, event attributes, sharing groups, and distribution controls.

Develop secure intelligence-sharing workflows aligned with classification and information-handling requirements.

Implement STIX/TAXII interoperability where required by the approved solution design.

Optimize MISP performance, scalability, reliability, and integration resilience.

Develop automated workflows for indicators of compromise, adversary profiling, threat hunting, and security alert enrichment.

Troubleshoot integration failures, data quality issues, API errors, and intelligence synchronization problems.

Support deployment in NATO UNCLASSIFIED and NATO SECRET environments.

Develop technical documentation, configuration baselines, test procedures, and operational runbooks.

Participate in system integration testing, security verification, customer acceptance, and operational transition.

Provide technical knowledge transfer to cybersecurity analysts and platform administrators.

Requirements

Required Qualifications

Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent professional experience.

7+ years of cybersecurity, software integration, or security engineering experience.

3+ years of hands-on MISP deployment, administration, development, or integration experience.

Demonstrated experience implementing MISP integrations in production environments.

Strong Python and PyMISP development skills.

Experience with REST APIs, JSON, STIX/TAXII, and threat intelligence data exchange.

Strong Linux administration and troubleshooting skills.

Understanding of MISP architecture, event models, taxonomies, galaxies, sharing groups, and distribution controls.

Experience integrating threat intelligence with SIEM, SOC, EDR, and security automation platforms.

Knowledge of the MITRE ATT&CK framework, threat intelligence lifecycle, and IOC management.

Experience developing and troubleshooting secure API-based integrations.

Ability to produce clear technical documentation and support formal integration testing.

Professional proficiency in English.

Ability to work at customer locations in Belgium.

Security Requirements

Must have an active NATO SECRET clearance or a national security clearance acceptable for NATO SECRET access, subject to formal verification.