Threat Engineer - Cyber Threat Management

About the role

ING Hubs Spain is looking for a Threat Engineer to join its Global Threat Management Team in the Cyber Threat Management area. The team turns threat intelligence and security telemetry into actionable insights that strengthen detection, prioritisation and cybersecurity decisions, combining cybersecurity expertise with software engineering, cloud infrastructure and data analysis.

Key responsibilities

• Design and implement scalable automations that help detect, prioritise and investigate cyber threats.
• Co-create intelligence-driven security solutions with threat intelligence specialists, cybersecurity experts and architects.
• Turn security telemetry and threat intelligence data into actionable insights for operational teams and executives.
• Automate threat analysis with standard and custom tooling, mainly built in Python.
• Deploy and run infrastructure and automations on Azure, Google Cloud Platform and Databricks, with scalability, reliability and governance.
• Build integrations across data sources, security tools and services.
• Use AI, GenAI and automation selectively and securely to streamline workflows.
• Create technical documentation, diagrams and visualisations for technical and non-technical stakeholders.
• Troubleshoot deployment, installation, configuration and integration issues.
• Maintain CI/CD pipelines and use version control.

Required profile

• Ability to turn complex cyber threat challenges into data-driven technical solutions.
• Strong Python skills, including Jupyter Notebooks.
• Hands-on cloud deployment experience (Azure, GCP) with Terraform or similar IaC.
• Experience with GenAI or large language models, focused on measurable operational value.
• Understanding of cloud platforms, networking, system administration and CISO organisational models.
• Experience fixing deployment and integration issues, and building CI/CD pipelines with Git.
• Familiarity with malware behaviour, threat actors and adversary TTPs.
• Nice to have: threat intelligence platforms, Databricks, AI/GenAI solution building, security automation/orchestration platforms, and threat-modelling frameworks such as Cyber Kill Chain and MITRE ATT&CK.

What we offer

• Flexible working: choose your own home-working days.
• Restaurant card and transport allowance.
• On-site facilities: electric mobility, doctor, hairdresser, gym, errand service.
• Health and life insurance for you and your family.
• Pension plan after 1 month.