Threat Intelligence Platform (TIP) Consultant / Forward Deployed Engineer

Threat Intelligence Platform (TIP) Consultant / Forward Deployed Engineer

NATO-related programme | 6-month contract | Immediate start

Morela is proud to be supporting a real-time AI detection business with a 6-month contract engagement for a Threat Intelligence Platform (TIP) Consultant / Forward Deployed Engineer on a NATO-related programme, starting immediately. The role is hybrid between the UK and Belgium, with a few days per month on-site with the end client in Belgium. The day rate is negotiable for the right consultant, and relevant NATO security clearance would be highly advantageous.

The Role

As the TIP Consultant / FDE, you will be the hands-on technical lead embedded with the end client, responsible for getting the platform deployed, integrated and delivering real operational value. You will sit between the client’s security and intelligence teams and the product, translating operational requirements into working configuration, integrations and automation.

This is a forward deployed role: highly technical, highly client-facing and focused on outcomes. You will own the implementation end to end, from understanding the client’s workflows through to go-live and handover, working in a secure environment with real mission impact.

Responsibilities

• Lead the implementation and configuration of the threat intelligence platform within the client environment
• Run discovery and requirements sessions with analysts, SOC and CTI teams to understand intelligence workflows and priorities
• Design and build integrations with the client’s existing security tooling, such as SIEM, SOAR, EDR, ticketing and case management systems
• Configure data ingestion from internal and external intelligence feeds, including normalisation, enrichment and deduplication
• Build automation and playbooks to streamline triage, enrichment and response workflows
• Develop scripts and connectors using platform APIs to extend functionality where needed
• Map intelligence to frameworks such as MITRE ATT&CK and support standards-based sharing (STIX/TAXII)
• Troubleshoot technical issues on site and feed product insight back to the client’s engineering and product teams
• Produce clear documentation, runbooks and training so the client’s teams can run the platform independently
• Operate in line with the security requirements of a NATO-related environment at all times

Essential Requirements

• Hands-on experience implementing or administering cyber threat intelligence platforms (e.g. MISP, Anomali, OpenCTI, Recorded Future or similar)
• Strong background in system integration, REST APIs and data ingestion pipelines
• Scripting and automation skills, ideally in Python
• Solid understanding of the cyber threat intelligence lifecycle and how CTI supports SOC and incident response teams
• Experience integrating with security tooling such as SIEM and SOAR platforms
• Confident, client-facing delivery skills, comfortable leading workshops and working directly with technical and non-technical stakeholders
• Experience working in secure or regulated environments
• Able to travel to Belgium a few days per month

Desirable Experience

• Current NATO security clearance, or UK SC/DV clearance
• Previous experience in a Forward Deployed Engineer, Solutions Engineer or Professional Services role
• Background in defence, government or public sector security programmes
• Familiarity with STIX/TAXII, MITRE ATT&CK and intelligence sharing standards
• Experience with OSINT, real-time alerting or event detection platforms
• Knowledge of cloud and on-premise deployment in air-gapped or restricted environments

Working Environment

This is a 6-month contract with an immediate start, working hybrid between the UK and Belgium with a few days per month on-site with the end client. You will work closely with the end client’s security and intelligence teams, with support from our client’s product and engineering teams. It is a fast-moving, mission-focused engagement that suits someone who enjoys owning delivery and seeing their work go live in a real operational setting.

If this sounds like you, please get in touch with your availability, relevant experience and day rate.