5+ years of experience in technical security engineering roles, with 3+ years focused on threat intelligence. Strong understanding of modern attacker TTPs, including cloud-native, SaaS, identity-focused, and insider-adjacent threat patterns. Experience developing intelligence requirements, prioritization frameworks, analysis workflows, and emulation scenarios. Hands-on experience with scripting or automation (e.g., Python, APIs, SOAR workflows). Ability to produce concise, high-quality written intelligence, including executive-level summaries. Familiarity with security telemetry, logs, and investigative workflows used by detection and response teams. Willingness to participate in an on-call rotation and support security incidents during high-severity or off-hours events.