Senior Research Engineer, Threat Intelligence

SecurityScorecard
United States
Workplace: RemoteFull timeUSD 14,000 - 150,000 annuallyFunction: Research & Scientific (R&D)Experience: 5-8 yearsEducation: high_schoolSkills: ["Cross-functional collaboration","Delivery focus","Healthy skepticism","Automation mindset","Model-informed decision-making"]

Build threat-intelligence research-to-production pipelines within the STRIKE team, turning malware findings and indicators into detection rules, distributed feeds, scoring inputs, and platform APIs. Own platform components across services and runtimes, implement standards-based schemas using STIX 2.1/TAXII 2.1, and ship detection content (YARA, Sigma, STIX patterns). Engineer automation that reduces research overhead and improves workflow safety, while collaborating cross-functionally to get signals into product.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
SecurityScorecard
SecurityScorecard
2 months ago

Senior Research Engineer, Threat Intelligence

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 13 hours agoStatus: Live

Job Summary

Build threat-intelligence research-to-production pipelines within the STRIKE team, turning malware findings and indicators into detection rules, distributed feeds, scoring inputs, and platform APIs. Own platform components across services and runtimes, implement standards-based schemas using STIX 2.1/TAXII 2.1, and ship detection content (YARA, Sigma, STIX patterns). Engineer automation that reduces research overhead and improves workflow safety, while collaborating cross-functionally to get signals into product.
Location: United States
Workplace: Remote
Employment Type: Full time
Job Function: Research & Scientific (R&D)
Seniority: Mid level

Key Responsibilities

  • •Own the path from research output to production-ready artifacts like detection rules, distributed feeds, scoring inputs, or customer alerts.
  • •Build and maintain STRIKE threat-intelligence platform components across multiple services and runtimes, including distribution, sandbox orchestration, OSINT ingestion, sharing endpoints, agent runtimes, and rules engines.
  • •Turn research into shipped detection content using YARA, Sigma, STIX patterns, behavioral indicators, and the pipelines that distribute them.
  • •Drive STIX 2.1 adoption as a unified output schema and TAXII 2.1 as a distribution standard, defining and governing schemas for downstream teams.
  • •Engineer automation for research workflows (enrichment, corpus correlation, feed normalization, sandbox triage) and create eval harnesses to catch regressions before analysts do.

Pay and Benefits

Salary: USD 14,000 - 150,000 annually
Equity and Bonus:Equity
Perks:EquityHealth InsurancePaid LeaveParental Leave

Key Requirements

  • •Bachelor’s or Master’s in Computer Science, Cybersecurity, or a related technical field; self-taught practitioners with strong public work are welcome.
  • •5 to 8 years in a hands-on engineering role with exposure to threat intelligence, security research, or detection engineering, including production systems that consume or emit threat intel data.
  • •Production-level Python and TypeScript/Node experience.
  • •Experience with relational and cache data stores, plus at least one streaming or batch data platform.
  • •Working knowledge of STIX 2.1, TAXII 2.1, MISP, and MITRE ATT&CK, and hands-on detection tooling (YARA, Sigma, STIX patterning).
Experience:5-8 yearsThreat intelligenceSecurity researchDetection engineering
Education:High School in Computer Science, Cybersecurity, or related technical field
Skills:Cross-functional collaborationDelivery focusHealthy skepticismAutomation mindsetModel-informed decision-making
Languages:English
Tech Stack:PythonTypeScriptNodeAWSContainersCI/CDSTIX 2.1TAXII 2.1MISPMITRE ATT&CKYARASigmaSTIX patterningSQLRegexCELOPASplunkKinesisNetFlow

Eligibility

Work Authorization:Authorization required. Sponsorship not provided.

Company Brief

SecurityScorecard
Provides a cybersecurity ratings platform that continuously assesses and monitors organizations' and third-party vendors' security posture using external data and analytics to help enterprises manage risk, prioritize remediation, and inform vendor risk decisions.
Industry: Cybersecurity
Company Size: Enterprise (1,001+ employees)
Growth: Scaleup
Headquarters: New York, United States
Founded: 2013
WebsiteLinkedIn