Impress employers and recruiters.
Choose from hundreds of resume examples.
Impress employers and recruiters.
Choose from hundreds of resume examples.
Target Resume Now
Tailor your resume to this Lead Threat Intelligence Engineer role.
Rezi rewrites your resume against Clio's job description. Free.
Tailor your resume to this Lead Threat Intelligence Engineer role.
Rezi rewrites your resume against Clio's job description. Free.
Don't guess if your resume is good enough.
See how it scores against the Lead Threat Intelligence Engineer posting at Clio — free, in seconds.
Don't guess if your resume is good enough.
See how it scores against the Lead Threat Intelligence Engineer posting at Clio — free, in seconds.
About the Role
Clio is building a dedicated threat intelligence capability to formally track adversaries targeting the company and similar organizations. This senior individual-contributor role will establish the foundation for this new function, defining how threat intelligence is characterized, tracked, and acted upon by other teams.
Responsibilities
- Define and maintain Clio's Priority Intelligence Requirements with stakeholders across Security, Trust, Payments, and leadership.
- Run the full intelligence lifecycle from requirements through dissemination and feedback.
- Stand up Clio's threat intelligence platform and make it the system of record for tracked actors, campaigns, and indicators.
- Shape vendor purchases and tooling rollouts, including OSINT and dark-web monitoring, feeds, and enrichment.
- Measure intelligence effectiveness by tracking detection coverage in the SIEM, Red Team campaign success, and time-to-detect on incidents.
- Track external threat actors, techniques, and infrastructure relevant to legal tech and Clio's customer base.
- Produce intelligence at tactical, operational, and strategic tiers.
- Establish and refine Clio's methodology for tracking adversary campaigns.
- Produce original research, including infrastructure hunting and malware/campaign attribution.
- Analyze fraud and abuse patterns and insider-threat signals.
- Track BEC and trust-account wire-fraud tradecraft targeting law firms.
- Assess coordinated disclosure and patch-storm events for exploitation urgency.
- Provide the Red Team with a prioritized, evidence-backed list of techniques to simulate.
- Provide the detection engineer with intel-backed detection requirements.
- Brief security leadership, the SOC, and engineering teams.
- Alert Payment Operations of external signals like tracked actors and fraud rings.
- Manage commercial threat-intel feed vendors and evaluate new ones.
- Participate in industry intel-sharing groups and represent Clio.
- Collaborate and code with the blue team on defensive remediations.
Requirements
- 5+ years in threat intelligence or a closely adjacent function, with original research.
- Experience establishing or scaling a security function/team from the ground up.
- Scripting ability (Ruby, Python, or similar) for automation.
- Fluency with MITRE ATT&CK, the Diamond Model, and structured analytic techniques.
- Track record of establishing or materially improving a tracking methodology.
- Comfort briefing both technical teams and director+ level.
- Ability to turn raw intelligence into specific, actionable asks for other teams.
- Fluency with AI tooling in analytical work, including agents for collection, enrichment, and drafting.
- Experience mentoring more junior analysts.
- Existing relationships in industry intel-sharing communities (Bonus).
- Experience with fraud or insider-threat analysis, or financial services cybercrime experience (Bonus).
- Familiarity with the legal-tech or professional-services threat landscape, or ability to build that context quickly (Bonus).
Skills
- Threat intelligence
- Adversary tracking
- Fraud pattern analysis
- Abuse intelligence
- Red teaming collaboration
- Detection engineering collaboration
- SIEM (Splunk, ELK/OpenSearch)
- OSINT
- Dark-web monitoring
- Infrastructure hunting
- Malware attribution
- Campaign attribution
- BEC tracking
- Wire-fraud detection
- Coordinated disclosure analysis
- Patch management analysis
- Vendor management
- Industry intel-sharing
- Ruby
- Python
- MITRE ATT&CK
- Diamond Model
- Analysis of Competing Hypotheses
- AI tooling
- AI agents
Location
- Vancouver
- Calgary
- Toronto
- Dublin
- London
- New York City
- Sydney
Work Type
- Hybrid
Experience Level
- Senior individual-contributor
- 5+ years
Salary/Compensations
- $157,300 to $212,800 CAD
Benefits
- Competitive, equitable salary
- Top-tier health benefits
- Dental insurance
- Vision insurance
- Hybrid work environment
- Flexible time off policy (encouraged 20 days off per year)
- $2000 annual counseling benefit
- RRSP matching
- RESP contribution
- Clioversary recognition program
About the Company
- Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely.
- We are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice.
- We're a Human and High Performing AI company, meaning we use artificial intelligence to improve all of our operations.
Equal Opportunity
- We are dedicated to diversity, equity and inclusion.
- We believe that different perspectives, skills, backgrounds, and experiences result in higher-performing teams and better innovation.
- We are committed to equal employment and we encourage candidates from all backgrounds to apply.
- Clio provides accessibility accommodations during the recruitment process.