Senior MISP Integration Engineer – Cyber Threat Intelligence

Position Overview

We are seeking a highly experienced Senior MISP Integration Engineer to support the modernization and integration of a Cyber Threat Intelligence (CTI) capability within a multinational defense environment.

The successful candidate will bring deep hands-on expertise in the Malware Information Sharing Platform (MISP), threat intelligence automation, API integrations, intelligence enrichment, and secure information-sharing workflows.

This role is suited to an engineer who has deployed, configured, integrated, and maintained MISP in production environments and understands how threat intelligence supports real-world security operations.

Key Responsibilities

• Assess, configure, enhance, and integrate existing MISP instances within enterprise cybersecurity environments.
  

• Design and implement MISP integrations with SIEM, EDR, threat intelligence feeds, vulnerability management, and other cybersecurity platforms.
  

• Develop and maintain integrations using PyMISP, REST APIs, Python, and supported intelligence exchange mechanisms.
  

• Implement automated intelligence collection, enrichment, normalization, deduplication, correlation, and distribution workflows.
  

• Configure MISP taxonomies, galaxies, warning lists, event attributes, sharing groups, and distribution controls.
  

• Develop secure intelligence-sharing workflows aligned with classification and information-handling requirements.
  

• Implement STIX/TAXII interoperability where required by the approved solution design.
  

• Optimize MISP performance, scalability, reliability, and integration resilience.
  

• Develop automated workflows for indicators of compromise, adversary profiling, threat hunting, and security alert enrichment.
  

• Troubleshoot integration failures, data quality issues, API errors, and intelligence synchronization problems.
  

• Support deployment in NATO UNCLASSIFIED and NATO SECRET environments.
  

• Develop technical documentation, configuration baselines, test procedures, and operational runbooks.
  

• Participate in system integration testing, security verification, customer acceptance, and operational transition.
  

• Provide technical knowledge transfer to cybersecurity analysts and platform administrators.
  

Requirements

Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent professional experience.
  

• 7+ years of cybersecurity, software integration, or security engineering experience.
  

• 3+ years of hands-on MISP deployment, administration, development, or integration experience.
  

• Demonstrated experience implementing MISP integrations in production environments.
  

• Strong Python and PyMISP development skills.
  

• Experience with REST APIs, JSON, STIX/TAXII, and threat intelligence data exchange.
  

• Strong Linux administration and troubleshooting skills.
  

• Understanding of MISP architecture, event models, taxonomies, galaxies, sharing groups, and distribution controls.
  

• Experience integrating threat intelligence with SIEM, SOC, EDR, and security automation platforms.
  

• Knowledge of the MITRE ATT&CK framework, threat intelligence lifecycle, and IOC management.
  

• Experience developing and troubleshooting secure API-based integrations.
  

• Ability to produce clear technical documentation and support formal integration testing.