Research - engineering

Overview You'll join STRIKE, SecurityScorecard's Threat Intelligence team, as the engineering counterpart to research. STRIKE runs several research motions in parallel, each on its own clock: rapid response to active events, longer product-tied work, and standards-anchored research on a quarterly cadence. The path from a finding to a shipped detection or feed gets reinvented every time. You'll work directly with the senior technical leader who owns STRIKE's R&D direction, and report to the Head of Threat Research for people management. You'll take a research artifact (a malware finding, an infrastructure cluster, a new indicator class, a behavioral pattern) and turn it into something the company can use without a second round of engineering: schemas, pipeline hooks, distribution feeds, detection rules, or platform APIs.

This isn't a pure research role, and it isn't a pure platform role either. Researchers ideate, you ship.

Key Responsibilities Own the path from research output to production-ready artifact: a detection rule, a distributed feed, a scoring input, or a customer alert. Build and maintain STRIKE platform components across multiple services and runtimes, including distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines that operate over standards-anchored predicates. Extend these systems without breaking the data contracts already in production.

Detection Content and Signal Production Turn research into shipped detection content: YARA, Sigma, STIX patterns, behavioral indicators, and the pipelines that distribute them. Build correlation pipelines that link scan data, attack surface signals, vulnerability data, and adversary tracking into customer-facing intelligence.

Data Model and Standards Adoption Drive STIX 2.1 adoption as a unified output schema and TAXII 2.1 as a distribution standard. Research Workflow Engineering Build the automation that removes commodity overhead from research work: indicator enrichment, report drafting, corpus correlation, feed normalization, and sandbox triage. Help move the team from analyst-driven, model-assisted workflows toward model-driven workflows with analyst review.

a SQL query beats a model for structured data. Cross-Functional Delivery Coordinate with engineering, measurement, and platform product teams so research actually lands in product. You'll often serve as the engineering voice translating between researchers, product managers, and platform engineers, and you may occasionally explain the work to customers, journalists, or executives.

Bachelor's or Master\'s in Computer Science, Cybersecurity, or a related technical field. Experience: 5 to 8 years in a hands-on engineering role with meaningful exposure to threat intelligence, security research, or detection engineering. Prior experience building production systems that consume or emit threat intel data is required.

Python and TypeScript/Node at a production level

Relational and cache data stores, plus at least one streaming or batch data platform

Cloud infrastructure (AWS preferred), containers, and CI/CD pipelines

Detection and Research Tooling: Comfortable reading malware analysis output, parsing adversary infrastructure data, and writing detection logic that holds up under production load.

Applied Language Models: You\'ve shipped production systems that use language models, not just demos. That includes retrieval over a real corpus, structured output with schema validation, eval harnesses that catch regressions before users do, and a solid understanding of where models fail: recency, long-tail facts, numerical reasoning, and adversarial input or prompt injection. You can do the cost-per-task math for your workloads, and you can make the case when a smaller, tightly scaffolded model beats a larger one.

The bar for shipping a model-generated indicator or detection is higher than for shipping a regex, and you understand why and design accordingly.

Bridge Mindset: You write code that ships, and you understand why researchers think the way they do. If you\'ve taken an idea sketched out in a chat message and turned it into a deployed pipeline before the next sprint began, that\'s the mode we\'re looking for.

Bonus:

Experience with policy-as-code or expression-language engines (CEL, OPA, or similar)

Published or co-authored security research (campaigns, vulnerabilities, adversary tracking)

Large-scale telemetry experience (Splunk, Kinesis, NetFlow, or equivalent)

Contributor or maintainer on open-source threat intel projects (MISP, OpenCTI, Sigma, STIX, ATT&CK)

Familiarity with quantitative risk frameworks such as FAIR

Familiarity with Golang at a production level

Specific to each country, we offer a competitive salary, stock options, Health benefits, and unlimited PTO, parental leave, tuition reimbursements, and much more!

The estimated total compensation range for this position is $140,000 - $150,000 (base plus bonus). In addition to base salary, employees may also be eligible for annual performance-based incentive compensation awards and equity, among other company benefits.

SecurityScorecard is committed to Equal Employment Opportunity and embraces diversity. We make hiring decisions based on merit and do not discriminate based on race, color, religion, national origin, sex or gender (including pregnancy) gender identity or expression (including transgender status), sexual orientation, age, marital, veteran, disability status or any other protected category in accordance with applicable law.

We also consider qualified applicants regardless of criminal histories, in accordance with applicable law. We are committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need assistance or accommodation due to a disability, please contact View email address on click.appcast.io information you submit to SecurityScorecard as part of your application will be processed in accordance with the Company’s privacy policy and applicable law.

Please note that we do not provide immigration sponsorship for this position.

#