Threat Intelligence Engineer
Threat Intelligence Engineer at Take-Two Interactive (Toronto) supporting the cyber threat intelligence program: managing threat feeds, parsing IOCs, integrating intel into SIEM/EDR/firewalls, and automating workflows with APIs and scripts. Requires 2-4 years in cybersecurity with hands-on SIEM/TIP/EDR experience.
- Compensation
- CA$71.4K–CA$105.7K / yr
- Location
- Toronto, Canada
- Work setup
- Onsite
- Seniority
- Not specified
- Employment
- Full time
- Experience
- 1+ years
- Category
- Security
- Posted
Skills
Must have
- 2-4 years of experience in cybersecurity, with 1-2 years focused on threat intelligence, security engineering, or security operations (SOC)
- Solid understanding of network fundamentals, operating system internals, common attack vectors, and the cyber threat landscape
- Experience working with APIs, data formats (JSON, XML, STIX/TAXII), and systems integration
- Ability to analyze data from various sources (OSINT, technical reports, internal logs) to identify malicious activity
- Familiarity with threat intelligence and security frameworks like MITRE ATT&CK and the Cyber Kill Chain
- Strong written and verbal communication skills with ability to document engineering processes
- Hands-on experience with SIEM systems, threat intelligence platforms (TIPs), or EDR solutions
Nice to have
- Proficiency in scripting languages such as Python, PowerShell, or Bash
- Relevant certifications such as CompTIA Security+/CySA+ or GIAC (GSEC, GCTI)
- Familiarity with securing and monitoring cloud environments (AWS, Azure, or GCP)
- Basic understanding of malware analysis or reverse engineering concepts
Full description
WHO WE ARE
Take-Two Interactive Software, Inc. is a leading developer, publisher, and marketer of interactive entertainment for consumers around the globe. The Company develops and publishes products principally through Rockstar Games, 2K, Private Division, and Zynga. Our products are currently designed for console gaming systems, PC, and Mobile, including smartphones and tablets, and are delivered through physical retail, digital download, online platforms, and cloud streaming services. The Company’s common stock is publicly traded on NASDAQ under the symbol TTWO.
While our offices (physical and virtual) are casual and inviting, we are deeply committed to our core tenets of creativity, innovation and efficiency, and individual and team development opportunities. Our industry and business are continually evolving and fast-paced, providing numerous opportunities to learn and hone your skills. We work hard, but we also like to have fun and believe that we provide a great place to come to work each day to pursue your passions.
THE CHALLENGE
We are looking for a Threat Intelligence Engineer. In this role, you will be on the front lines of our defense, helping to operationalize intelligence and build engineering solutions to counter emerging security threats. You'll work closely with various security and technology teams to integrate threat data into our security infrastructure, strengthening our defenses and protecting our organization. Your hands-on expertise will directly contribute to safeguarding Take-Two and its labels' systems, networks, and data. You will work with Take-Two's Information Security teams, reporting to the Director of Threat Intelligence.
WHAT YOU’LL TAKE ON
- Threat Intelligence Operations: Support the day-to-day operations of the cyber threat intelligence (CTI) program by managing threat feeds, parsing indicators of compromise (IOCs), and ensuring data quality across our platforms.
- Threat Analysis & Engineering: Analyze emerging threats and adversary tactics, techniques, and procedures (TTPs) to help engineer robust detection and prevention mechanisms.
- Enhance Our Security Posture: Collaborate with our Global Security Operations Center (GSOC), Detection Engineering, and Incident Response teams to ingest and operationalize threat intelligence into our SIEM, EDR, and firewalls.
- Automation & Integration: Build and maintain API integrations, scripts, and playbooks to automate indicator ingestion, correlation, and dissemination across security platforms.
- Security Infrastructure Support: Assist in the deployment, configuration, maintenance, and tuning of our Threat Intelligence Platforms (TIP) and related security engineering tools.