> Markdown version of [/jobs/ext/4656794-lead-threat-intelligence-engineer](https://www.wearedevelopers.com/jobs/ext/4656794-lead-threat-intelligence-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Threat Intelligence Engineer - **Company:** LF Sportswear, Inc. - **Location:** Toronto, OH, United States - **Experience:** Expert - **Salary:** $157,300 - $212,800 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Fraud Prevention and Detection, Python (Programming Language), Open Source Intelligence, Pattern Recognition, Raw Data, Red Team (Cyber Security), Ruby, Security Information and Event Management, Scripting, Mitre Att&ck, Cyber Threat Analysis, Information Technology, Cybercrime, Splunk, OpenSearch, Blue Team (Cyber Security) - **Published:** November 10, 2026 - **Apply:** https://www.careerbuilder.com/job-details/lead-threat-intelligence-engineer-toronto-oh--47284ac2-e61d-45f0-a4e4-4c8b0bf5d8a0 ## About the Role * 5+ years in threat intelligence or a closely adjacent function, with original research you can point to * Experience establishing or scaling a security function/team from the ground up, not just operating inside an existing one. Self-starter. * Scripting ability (Ruby, Python, or similar) for building, upgrading, and maintaining automation * Fluency with MITRE ATT&CK, the Diamond Model, and structured analytic techniques such as Analysis of Competing Hypotheses, applied in your own analysis * Track record of establishing or materially improving a tracking methodology someone else now uses * Comfort briefing both technical teams and director+ level, and adjusting the message for each * Ability to turn raw intelligence into a specific, actionable ask for another team - a detection to write, a technique to simulate, a vendor risk to flag * Fluency with AI tooling in analytical work - agents for collection, enrichment, and drafting - and the judgment to validate what they produce * Experience mentoring more junior analysts Bonus Points * Existing relationships in industry intel-sharing communities * Experience with fraud or insider-threat analysis in addition to external threat tracking, or financial services cybercrime experience * Familiarity with the legal-tech or professional-services threat landscape, or ability to build that context quickly ## Description * Writing fraud pattern briefs from account-abuse signals and handing the Trust (anti-abuse) function specific patterns to detect * Working with our payment operations group to identify fraud patterns and rings within Clio Payments * Mentoring newer analysts on how to separate a credible early indicator from noise * Proposing a new data source or tracking method because the current one is missing a class of activity What You'll Do Building the program * Define and maintain Clio's Priority Intelligence Requirements with stakeholders across Security, Trust, Payments, and leadership, then run the full intelligence lifecycle against them - from requirements through dissemination and feedback * Stand up Clio's threat intelligence platform and make it the system of record for tracked actors, campaigns, and indicators * Shape vendor purchases and tooling rollouts- OSINT and dark-web monitoring, feeds, enrichment - as the program's collection needs take form * Measure whether intelligence changes outcomes: detection coverage in the SIEM (Splunk, ELK/OpenSearch), Red Team campaign success grounded in your reporting, and time-to-detect on incidents with prior intel coverage Intelligence production * Track external threat actors, techniques, and infrastructure relevant to legal tech and Clio's customer base * Produce intelligence at three tiers: tactical indicators and TTPs for detection, operational campaign briefs for security leadership, and strategic landscape assessments for executives * Establish and refine Clio's methodology for tracking adversary campaigns, rather than running someone else's playbook * Produce original research: infrastructure hunting from raw data, malware and campaign attribution * Analyze fraud and abuse patterns and insider-threat signals, and turn them into briefs the Trust (anti-abuse) function can act on * Track BEC and trust-account wire-fraud tradecraft targeting law firms, and feed it into fraud detection for Clio Payments * Assess coordinated disclosure and patch-storm events for real exploitation urgency Feeding other teams * Hand Red Team a prioritized, evidence-backed list of techniques worth simulating * Hand our detection engineer intel-backed detection requirements * Brief security leadership directly, in addition to the SOC and engineering teams * Alert Payment Operations of external signals: tracked actors, fraud rings, known malicious domains/IPs, etc. to filter fraud from our payments business before they can act External relationships * Manage commercial threat-intel feed vendors and evaluate new ones against cost and signal quality * Participate in industry intel-sharing groups and represent Clio in those relationships * Collaborate and code with the blue team on defensive remediations