Senior Threat Intelligence Engineer

Job Description

Requirements
- -----------

### Must have:

### - We are looking for a Bachelors or Masters degree in Computer Science, Cybersecurity, or a related technical discipline; self-taught professionals with strong public work are also welcome. - We need 5 to 8 years of hands-on engineering experience with meaningful exposure to threat intelligence, security research, or detection engineering. - We require prior experience building production systems that consume or produce threat intelligence data. - We expect production-level proficiency in Python and TypeScript/Node. - We need experience with relational and cache data stores, plus at least one streaming or batch data platform. - We require familiarity with cloud infrastructure, preferably AWS, as well as containers and CI/CD pipelines. - We expect working knowledge of STIX 2.1, TAXII 2.1, MISP, and MITRE ATT\&CK, and how they work together in practice. - We need hands-on experience with YARA, Sigma, and STIX Patterning. - We are looking for someone comfortable reading malware analysis output, parsing adversary infrastructure data, and writing detection logic that performs reliably in production. - We require experience shipping production systems that use language models, including retrieval over real corpora, structured output with schema validation, and evaluation harnesses. - We need a strong understanding of where models fail, including recency limits, long-tail facts, numerical reasoning, and adversarial input or prompt injection. - We value the ability to assess cost-per-task and choose when a smaller, tightly scaffolded model is better than a larger one. - We want a candidate with a bridge mindset who writes code that ships and understands how researchers think. - Bonus experience includes policy-as-code or expression-language engines such as CEL or OPA. - Bonus experience includes published or co-authored security research, large-scale telemetry tools, open-source threat intel contributions, familiarity with FAIR, or production-level Golang.

Responsibilities:
- ----------------

- We own the path from research output to a production-ready artifact such as a detection rule, distributed feed, scoring input, or customer alert. - We partner with adjacent teams to define clean handoff contracts so new signals reach downstream systems with the right schema, value framing, and consumption pattern. - We build and maintain STRIKE platform components across multiple services and runtimes, including distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines. - We extend these systems without breaking the data contracts already in production. - We turn research into shipped detection content such as YARA, Sigma, STIX patterns, and behavioral indicators, along with the pipelines that distribute them. - We build correlation pipelines that connect scan data, attack surface signals, vulnerability data, and adversary tracking into customer-facing intelligence. - We drive STIX 2.1 adoption as a unified output schema and TAXII 2.1 as a distribution standard. - We define and govern schemas so they remain reliable for downstream teams. - We build automation that reduces routine research overhead, including indicator enrichment, report drafting, corpus correlation, feed normalization, and sandbox triage. - We help move the team from analyst-driven, model-assisted workflows toward model-driven workflows with analyst review. - We design supporting infrastructure such as retrieval grounded in our own corpus, schema-constrained outputs, evaluation harnesses, cost accounting, latency budgeting, prompt versioning, and output logging. - We coordinate with engineering, measurement, and platform product teams so research lands in product. - We act as the engineering voice between researchers, product managers, and platform engineers, and may occasionally explain the work to customers, journalists, or executives.
- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Company:
- -------

We are SecurityScorecard, the global leader in cybersecurity ratings, continuously tracking more than 12 million companies across 64 countries. Founded in 2013, we are backed by world-class investors and trusted by over 25,000 organizations for self-monitoring, third-party risk management, board reporting, and cyber insurance underwriting. Our New York City headquarters and culture have earned recognition from Inc., Crains New York, Fast Company, and Achievers, and we offer a competitive compensation package that includes salary, stock options, health benefits, unlimited PTO, parental leave, tuition reimbursement, and more. This role sits on STRIKE, our Threat Intelligence team, where we focus on turning research into production-ready security capabilities.
- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------