Security Engineer, Cyber Threat Intelligence - saronic

Saronic Technologies is a leader in revolutionizing autonomy at sea, dedicated to developing state-of-the-art solutions that enhance maritime operations through autonomous and intelligent platforms.

JOB OVERVIEW

Security at Saronic is a force multiplier, not a blocker. An autonomous-maritime defense company is a top-tier target for nation-state and advanced criminal actors, and we’re looking for a Security Engineer for Cyber Threat Intelligence to make sure we see them coming. This is a hands-on, doctrine-driven engineering role, not a reporting desk: you’ll run a real intelligence program and turn raw indicators into operational defenses.

You’ll work across Security Operations, Detection Engineering, Vulnerability Management, Physical Security, Insider Threat, Data Loss Prevention, and Red Team to focus on the adversaries targeting the defense industrial base.

This is an opportunity to help run the threat-intelligence function for a fast-growing defense company, fuse intelligence with detection engineering rather than isolating it as reporting, and directly shape how we anticipate threats to our vessels, supply chain, people, and data.

RESPONSIBILITIES

• Priority Intelligence

Requirements

& Collection: Help own and evolve our Priority Intelligence

Requirements

and collection-management framework, translating leadership decisions and our maritime-autonomy and defense-industrial-base threat model into tasked collection, hunts, and finished intelligence.

• Adversary Tracking: Track the priority adversaries, including nation-state, APT, and advanced criminal actors most likely to target defense, maritime, and the broader industrial base, along with their tooling, infrastructure, and tradecraft, and maintain adversary and campaign profiles.
• Turn Intelligence into Action: Operationalize indicators and TTPs into detections, hunts, and prioritized remediation, and build the pipelines and connectors that ingest, enrich, and correlate intel from commercial feeds and OSINT. Turn raw data into verified intelligence products that meaningfully influence decision-making at all levels of the organization.
• Fuse Internal & External: Fuse external intelligence with internal telemetry in our graph-based intelligence data store, running attack-path and identity-to-asset correlation to prioritize by real exposure rather than CVSS alone.
• Finished Intelligence: Produce concise, actionable intelligence and briefings for security leadership and cross-functional partners, applying analytic tradecraft, estimative language, calibrated confidence, and structured analytic techniques, and modeling with STIX and MITRE ATT&CK.