Senior Research Engineer, Threat Intelligence

Responsibilities

• Own the research-to-production pipeline, converting malware findings, infrastructure clusters, indicator classes, and behavioral patterns into production-ready detections, feeds, scoring inputs, alerts, and APIs.
• Build and maintain STRIKE platform components including distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines.
• Create detection content and correlation pipelines using YARA, Sigma, STIX patterns, scan data, attack-surface signals, vulnerability data, and adversary tracking.
• Drive adoption and governance of STIX 2.1 and TAXII 2.1 as unified output and distribution standards.
• Automate indicator enrichment, report drafting, corpus correlation, feed normalization, sandbox triage, retrieval, structured output validation, and regression evaluation.
• Design safe model-assisted workflows with source-grounded retrieval, schema-constrained outputs, prompt versioning, output logging, cost accounting, and latency budgeting.
• Coordinate with engineering, measurement, platform product, researchers, customers, journalists, and executives to deliver and explain threat intelligence capabilities.

Requirements

• Bachelor's or Master's degree in Computer Science, Cybersecurity, or a related technical field, or equivalent strong public work from a self-taught practitioner.
• 5 to 8 years of hands-on engineering experience with meaningful exposure to threat intelligence, security research, or detection engineering.
• Required experience building production systems that consume or emit threat intelligence data.
• Production-level Python and TypeScript/Node experience.
• Experience with relational and cache data stores and at least one streaming or batch data platform.
• Experience with cloud infrastructure, preferably AWS, containers, and CI/CD pipelines.
• Working knowledge of STIX 2.1, TAXII 2.1, MISP, and MITRE ATT&CK and how they work together in practice.
• Hands-on experience with YARA, Sigma, and STIX Patterning, including writing detection logic suitable for production load.
• Experience reading malware analysis output, parsing adversary infrastructure data, and building production systems using language models with retrieval, structured-output validation, and evaluation harnesses.
• Ability to assess model limitations, cost, latency, adversarial input, prompt injection, and when deterministic tools such as regex or SQL are more appropriate.
• Ability to translate between researchers, product managers, platform engineers, and other stakeholders while independently turning ideas into deployed pipelines.
• Preferred experience with policy-as-code or expression-language engines such as CEL or OPA; published security research; large-scale telemetry such as Splunk, Kinesis, or NetFlow; open-source threat intelligence projects; quantitative risk frameworks such as FAIR; or production-level Golang.

Benefits

• Competitive salary, stock options, health benefits, unlimited PTO, parental leave, tuition reimbursement, and additional country-specific benefits.
• The position is based at SecurityScorecard, which states that benefits vary by country.
• SecurityScorecard does not provide immigration sponsorship for this position.