> Markdown version of [/jobs/ext/3174026-cyber-threat-intelligence-cti-data-engineer](https://www.wearedevelopers.com/jobs/ext/3174026-cyber-threat-intelligence-cti-data-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Threat Intelligence (CTI) Data Engineer

- **Company:** Spektrum
- **Location:** Bergen, Belgium
- **Experience:** Expert
- **Contract:** Contract
- **Skills:** Computer Telephony Integration, Information Security Management, Intrusion Detection Systems, Python (Programming Language), Metadata, Open Source Technology, PHP Development, Security Information and Event Management, Scripting, Sysadmin, Cyber Threat Analysis, Splunk, Data Pipelines
- **Published:** September 2, 2026
- **Apply:** https://be.indeed.com/viewjob?jk=d48e66041823c62e

## About the Role

* 10+ years designing/managing data pipelines (transformation, models, schemas, metadata, workload management)
 * 10+ years supporting/leading data-focused operations and projects
 * Strong Python scripting
 * Solid understanding of cybersecurity principles and technologies
 * English proficiency to NATO STANAG 6001 Level 3 ("Professional Proficiency")
 * Bachelor's degree + 3 years' relevant experience, or 10+ years equivalent progressive expertise in lieu of degree

Desirable

 * Experience with MISP core format / STIX
 * Cyber threat intelligence analyst or incident responder background
 * Splunk experience
 * Experience with multinational cyber exercises (Locked Shields, Crossed Swords, Cyber Coalition)
 * MISP sysadmin experience; Python/PHP development for MISP
 * Open-source community engagement

## Description

This role sits in NATO's Cyber Incident Management Analysis Team (CIMAT) as a Senior Data Engineer supporting NATO's MISP threat intelligence platform. You'll own the data pipelines that ingest, normalize, and enrich threat intelligence feeds, and act as a subject-matter expert to the broader NATO MISP user community., * Design, build, and maintain pipelines ingesting threat data from diverse sources

 * Develop Python automation integrating MISP with SIEM, IDS, and other NATO subsystems
 * Normalize heterogeneous feeds into consistent schemas; enforce data quality (dedup, confidence scoring, indicator lifecycle, provenance)
 * Maintain documentation on MISP taxonomies, galaxies, and data-entry best practices
 * Provide SME guidance to NATO MISP community members on data curation/dissemination
 * Lead teams of MISP Operators during live exercises (daily feedback, quality control)
 * Plan and deliver MISP training sessions


## Related Videos

- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.](https://www.wearedevelopers.com/videos/100339-hacking-mssql-on-cloud-all-of-them-how-i-became-sysadmin-on-azure-aws-gcp-and-alibaba)
- [A Data Mesh needs Open Metadata](https://www.wearedevelopers.com/videos/505-a-data-mesh-needs-open-metadata)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Fake or News: Self-Driving Cars on Subscription, Crypto Attacks Rising and Working While You Sleep - Théodore Lefèvre](https://www.wearedevelopers.com/videos/1793-fake-or-news-self-driving-cars-on-subscription-crypto-attacks-rising-and-working-while-you-sleep-theodore-lefevre)
- [Crafting Custom Frameworks with Rust: A Deep Dive into Procedural Macros](https://www.wearedevelopers.com/videos/849-crafting-custom-frameworks-with-rust-a-deep-dive-into-procedural-macros)

## Related Articles

- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)