Sr. Engineer, Platform Threat Intelligence

About the role

Platform Threat Intelligence supports the security and trust of College Board systems by assessing relevant adversaries and translating that understanding into defensive outcomes. We focus on adversary objectives and behaviors that matter to our platform and work with engineering and operational partners to strengthen resilience, detection, and decision-making. The team produces high-confidence assessments of adversary behavior patterns and operational trends and communicates findings in ways that drive prioritized action. We collaborate with cross-functional stakeholders, including data and engineering partners, to improve visibility, coverage, and reporting using security-relevant datasets. In this role, you will translate adversary tactics and malware into actionable, measurable improvements that strengthen platform trust. You will partner with Data Science, engineering teams, and operational stakeholders to shape analytics, reporting, and detection enhancements informed by internal signals and investigative evidence. Key aspects of the role include: Intelligence-to-action translation: Convert intelligence and stakeholder questions into clearly defined analytic efforts and decision-ready outputs. Detection and measurement: Identify and monitor meaningful behavioral patterns in security-relevant signals to improve detection quality and operational outcomes. Reporting and decision support: Produce concise deliverables, recurring reporting, and targeted deep dives that inform prioritization and leadership visibility. Cross-functional execution: Work across engineering, data, and operational teams to integrate outputs into workflows and drive follow-through. You will follow established information protection and secure-handling practices for sensitive materials, and ensure work aligns with applicable policies and professional standards. Clear documentation is expected to support defensible decisions and repeatable operations. In this role, you will: Threat Intelligence & Analysis (70%) Collect, curate, and analyze actionable threat intelligence: including malware design trends and observed capabilities relevant to College Board products, platforms, and adjacent services, translating findings into clear risk insights and defensive priorities. Assess adversary behaviors and trends to identify defensive and investigative opportunities and inform stakeholder priorities. Maintain structured tracking of relevant threats and produce written assessments and briefings for technical and non-technical audiences. Partner with engineering teams to translate findings into security requirements and hardening priorities. Support operational stakeholders with analysis that informs investigations and related decision-making. Collaboration & Operational Excellence Operate as a cross-functional partner across engineering, data, and operational teams, maintaining strong working relationships. Communicate clearly through written outputs and collaborative discussions to drive aligned action. Contribute to repeatable workflows, documentation standards, and quality improvements that increase consistency and reliability. Uphold safe handling expectations for sensitive information, including compliant storage, access, and sharing practices. Applied Defensive Support (30%) Contribute to improving the quality and usefulness of security-relevant signals and analytic outputs that support detection and measurement efforts. When appropriate, support technical validation of hypotheses to reduce ambiguity and accelerate remediation, using policy-aligned approaches. About you, you have: 5-8 years of experience in threat intelligence, security engineering, security research, or a closely related field with demonstrated capability in Windows malware analysis. Proficiency with Python and at least one additional language for automation or prototyping. Experience performing technical analysis of adversary behaviors and tools using common industry techniques. Strong fundamentals in operating systems, networking, and attacker tradecraft, with the ability to explain technical findings clearly. Experience producing clear written intelligence products for technical and non-technical audiences. Ability to collaborate effectively across engineering and operational stakeholders in ambiguous environments. Commitment to secure handling of sensitive materials and ethical conduct. Cultural/operational context: An understanding of regional communication norms and online ecosystems relevant to threat research (e.g., local social platforms, forums, and media), with the ability to interpret nuance and context in reporting. Language skills: Ability to speak Mandarin and read/wri