Senior Research Engineer, Threat Intelligence

🔥 0 minutes ago

🇺🇸 United States – Remote

💵 $140k - $180k / year

⏰ Full Time

🟠 Senior

📚 Research Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

SecurityScorecard

WebsiteLinkedInAll Job Openings

501 - 1000 employees

Founded 2013

💼 Consulting

🏥 Healthcare

🛡️ Insurance

💰 $180M Series E on 2021-03

Consulting • Healthcare • Insurance

SecurityScorecard is a company that focuses on cybersecurity and risk management. It provides solutions for supply chain detection and response, third-party cyber risk management, and external attack surface management. By leveraging AI and security ratings, SecurityScorecard helps organizations improve their cybersecurity postures and manage risks effectively. The company's platform allows for monitoring and remediation of vulnerabilities, collaboration with vendors, and compliance with regulatory mandates. SecurityScorecard serves a diverse range of industries, including public sector, technology, healthcare, financial services, and more. Its comprehensive suite of tools and services, such as Security Ratings and MAX, empower organizations to proactively manage cyber risks and enhance their overall security structures.

📋 Description

• Join STRIKE, SecurityScorecard's Threat Intelligence team, as the engineering counterpart to research • Own delivery from research artifacts to production-ready detections, feeds, scoring inputs, or customer alerts • Define handoff contracts with adjacent teams, including schemas, value framing, and consumption patterns • Build and maintain platform components across distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines • Extend production systems without breaking existing data contracts • Turn research into YARA, Sigma, STIX patterns, behavioral indicators, and distribution pipelines • Build correlation pipelines linking scan data, attack surface signals, vulnerability data, and adversary tracking into customer-facing intelligence • Drive adoption of STIX 2.1 as a unified output schema and TAXII 2.1 as a distribution standard • Define and govern downstream-ready schemas • Automate indicator enrichment, report drafting, corpus correlation, feed normalization, and sandbox triage • Build retrieval-grounded workflows, schema-constrained outputs, regression evaluation harnesses, cost accounting, latency budgets, prompt versioning, and output logging • Coordinate with engineering, measurement, and platform product teams to deliver research into products • Translate between researchers, product managers, and platform engineers; occasionally explain work to customers, journalists, or executives • Report to the Head of Threat Research for people management, with technical direction from R&D leadership

🎯 Requirements

• Bachelor's or Master's in Computer Science, Cybersecurity, or a related technical field; self-taught practitioners with strong public work are welcome • 5 to 8 years in a hands-on engineering role with meaningful exposure to threat intelligence, security research, or detection engineering • Prior experience building production systems that consume or emit threat intel data is required • Python and TypeScript/Node at a production level • Relational and cache data stores, plus at least one streaming or batch data platform • Cloud infrastructure (AWS preferred), containers, and CI/CD pipelines • Working knowledge of STIX 2.1, TAXII 2.1, MISP, and MITRE ATT&CK, and how they work together in practice • Hands-on experience with YARA, Sigma, and STIX Patterning • Comfortable reading malware analysis output, parsing adversary infrastructure data, and writing detection logic that holds up under production load • Shipped production systems that use language models, including retrieval over a real corpus, structured output with schema validation, eval harnesses, and understanding of model failure modes • Ability to perform cost-per-task calculations and evaluate smaller, tightly scaffolded models versus larger models • Ability to write production code while understanding research workflows • No immigration sponsorship is provided for this position • Bonus: Experience with policy-as-code or expression-language engines (CEL, OPA, or similar) • Bonus: Published or co-authored security research • Bonus: Large-scale telemetry experience (Splunk, Kinesis, NetFlow, or equivalent) • Bonus: Contributor or maintainer on open-source threat intel projects • Bonus: Familiarity with quantitative risk frameworks such as FAIR • Bonus: Familiarity with Golang at a production level

🏖️ Benefits

• Competitive salary • Stock options • Health benefits • Unlimited PTO • Parental leave • Tuition reimbursements • Annual performance-based incentive compensation awards • Equity • Reasonable accommodations for qualified individuals with disabilities