Lead Threat Intelligence Engineer

Join Clio, a leading legal tech company, as a Lead Threat Intelligence Engineer. In this senior individual-contributor role, you will establish and formalize Clio's threat intelligence capability, working closely with the internal red team and detection engineer. You will use AI to scale collection, enrichment, triage, and reporting, and produce intelligence at three tiers: tactical indicators, operational campaign briefs, and strategic landscape assessments. You will also track external threat actors, techniques, and infrastructure relevant to legal tech and Clio's customer base.

• Establish and formalize how Clio tracks adversaries, including characterizing who is targeting Clio and organizations like it.
• Work closely with Clio's internal red team and detection engineer to turn threat intelligence into actionable work for other teams.
• Define and maintain Clio's Priority Intelligence Requirements with stakeholders across Security, Trust, Payments, and leadership, and run the full intelligence lifecycle against them.

• Fluency with MITRE ATT&CK, the Diamond Model, and structured analytic techniques such as Analysis of Competing Hypotheses, applied in your own analysis
• Scripting ability (Ruby, Python, or similar) for building, upgrading, and maintaining automation
• Fluency with AI tooling in analytical work — agents for collection, enrichment, and drafting — and the judgment to validate what they produce
• Experience establishing or scaling a security function/team from the ground up, not just operating inside an existing one. Self-starter
• Comfort briefing both technical teams and director+ level, and adjusting the message for each
• Track record of establishing or materially improving a tracking methodology someone else now uses
• 5+ years in threat intelligence or a closely adjacent function, with original research you can point to
• Experience mentoring more junior analysts
• Ability to turn raw intelligence into a specific, actionable ask for another team — a detection to write, a technique to simulate, a vendor risk to flag
• Existing relationships in industry intel-sharing communities
• Experience with fraud or insider-threat analysis in addition to external threat tracking, or financial services cybercrime experience
• Familiarity with the legal-tech or professional-services threat landscape, or ability to build that context quickly