Senior MISP Integration Engineer – Cyber Threat Intelligence (NATO SECRET)

Position Overview

We are seeking a highly experienced Senior MISP Integration Engineer to support the modernization and integration of a Cyber Threat Intelligence (CTI) capability within a multinational defense environment.

The successful candidate will bring deep hands-on expertise in the Malware Information Sharing Platform (MISP), threat intelligence automation, API integrations, intelligence enrichment, and secure information-sharing workflows.

This role is suited to an engineer who has deployed, configured, integrated, and maintained MISP in production environments and understands how threat intelligence supports real-world security operations.

Key Responsibilities

• Assess, configure, enhance, and integrate existing MISP instances within enterprise cybersecurity environments.
• Design and implement MISP integrations with SIEM, EDR, threat intelligence feeds, vulnerability management, and other cybersecurity platforms.
• Develop and maintain integrations using PyMISP, REST APIs, Python, and supported intelligence exchange mechanisms.
• Implement automated intelligence collection, enrichment, normalization, deduplication, correlation, and distribution workflows.
• Configure MISP taxonomies, galaxies, warning lists, event attributes, sharing groups, and distribution controls.
• Develop secure intelligence-sharing workflows aligned with classification and information-handling requirements.
• Implement STIX/TAXII interoperability where required by the approved solution design.
• Optimize MISP performance, scalability, reliability, and integration resilience.
• Develop automated workflows for indicators of compromise, adversary profiling, threat hunting, and security alert enrichment.
• Troubleshoot integration failures, data quality issues, API errors, and intelligence synchronization problems.
• Support deployment in NATO UNCLASSIFIED and NATO SECRET environments.
• Develop technical documentation, configuration baselines, test procedures, and operational runbooks.
• Participate in system integration testing, security verification, customer acceptance, and operational transition.
• Provide technical knowledge transfer to cybersecurity analysts and platform administrators.

Requirements

Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent professional experience.
• 7+ years of cybersecurity, software integration, or security engineering experience.
• 3+ years of hands-on MISP deployment, administration, development, or integration experience.
• Demonstrated experience implementing MISP integrations in production environments.
• Strong Python and PyMISP development skills.
• Experience with REST APIs, JSON, STIX/TAXII, and threat intelligence data exchange.
• Strong Linux administration and troubleshooting skills.
• Understanding of MISP architecture, event models, taxonomies, galaxies, sharing groups, and distribution controls.
• Experience integrating threat intelligence with SIEM, SOC, EDR, and security automation platforms.
• Knowledge of the MITRE ATT&CK framework, threat intelligence lifecycle, and IOC management.
• Experience developing and troubleshooting secure API-based integrations.
• Ability to produce clear technical documentation and support formal integration testing.
• Professional proficiency in English.
• Ability to work at customer locations in Belgium.

Security Requirements

Must have an active NATO SECRET clearance or a national security clearance acceptable for NATO SECRET access, subject to formal verification.