Senior Threat Intelligence Engineer

Role overview Lead threat intelligence work that helps organizations identify emerging vulnerabilities and active exploitation before they cause harm. The role spans vulnerability assessment, detection engineering, honeypot research, and urgent security communications, with close coordination across security, incident response, underwriting, product, and data teams.

Responsibilities - Run the zero-day alert workflow, from initial vulnerability triage through practical risk assessment and customer notification. - Coordinate urgent responses to severe or actively exploited issues with security support, underwriting, and incident response teams. - Develop technology fingerprints, scanner rules, and security findings that make scan data useful as reliable risk signals. - Operate and grow a distributed honeypot network; analyze its telemetry for exploitation patterns and emerging adversary methods. - Improve detection quality and limit false positives using vulnerability research, claims insights, and external datasets. - Publish security advisories, research, and briefings, and take part in emergency notification on-call coverage.

Requirements - At least five years of experience in threat intelligence, vulnerability research, penetration testing, or defensive security engineering. - Strong knowledge of network protocols, operating systems, web applications, and exploitation techniques such as remote code execution and authentication bypass. - Ability to assess new vulnerabilities quickly and explain their practical impact to organizations. - Experience writing scanner detections, signatures, or parsing scripts; strong Python skills and proficiency with SQL. - Hands-on familiarity with honeypots, deception systems, broad internet scanning, or similarly large security datasets. - Clear technical and nontechnical communication, strong documentation or security writing, and sound judgment when leading complex work independently.

Nice to have - Experience with internet asset discovery or attack surface mapping tools; reverse engineering, patch comparison, or exploit proof-of-concept verification. - Familiarity with VPNs, firewalls, load balancers, or industrial control systems; published research, vulnerability credits, or conference talks. - Knowledge of cyber insurance, underwriting, or risk aggregation.

Benefits and work setup - Remote-first work arrangement, flexible paid time off, and an annual home office stipend with coworking access. - Medical, dental, and vision coverage, plus wellness programs and opportunities for advancement.