Senior Threat Intelligence Engineer

Role overview

Identify emerging vulnerabilities and exploitation activity early, then turn research and telemetry into practical security guidance for businesses. You’ll lead key stages of urgent vulnerability alerting and develop the detections, honeypots, and threat intelligence that inform risk decisions, working across security, incident response, underwriting, product, and data teams.

Responsibilities

- Lead vulnerability triage through the preparation and delivery of actionable alerts to affected policyholders. - Coordinate urgent response and communications for severe or actively exploited vulnerabilities. - Develop and refine technology fingerprints, scanner detections, and findings that convert scan results into reliable risk signals. - Operate and expand a distributed honeypot network, analyzing activity for exploitation and new adversary methods. - Improve detection precision and reduce false positives using claims information, external data, and vulnerability research. - Publish advisories, research, and briefings, and participate in an on-call rotation for emergency alerts.

Requirements

- At least five years in threat intelligence, vulnerability research, penetration testing, or defensive security engineering. - Deep understanding of network protocols, operating systems, web applications, and exploitation techniques such as remote code execution and authentication bypass. - Ability to assess emerging vulnerabilities quickly and explain their practical impact on enterprise risk. - Hands-on experience writing scanner detections, signatures, or parsing scripts using Python, regular expressions, or protocol fingerprints. - Experience with honeypots, deception systems, internet-wide scanning, or large security datasets. - Strong Python and SQL skills, clear communication, and a record of useful technical documentation or security writing. - Sound judgment to lead complex investigations independently.

Nice to have

- Familiarity with internet asset search or attack surface mapping platforms. - Experience with reverse engineering, patch comparison, or validating proof-of-concept exploits. - Knowledge of VPNs, firewalls, load balancers, or industrial control systems. - Public security research, vulnerability credits, or conference presentations. - Exposure to cyber insurance, underwriting, or risk aggregation models.

Benefits and work setup

The organization describes its culture as remote-first. Benefits include medical, dental, and vision coverage, flexible paid time off, an annual home-office stipend, coworking access, and mental and physical wellness programs.