Senior Research Engineer, Threat Intelligence

SecurityScorecard

Senior Research Engineer responsible for transforming research into production-ready artifacts for threat intelligence. Working on the STRIKE team at SecurityScorecard, focusing on cybersecurity ratings.

Posted 7/1/2026full-timeRemote • Massachusetts • 🇺🇸 United StatesSenior💰 $140,000 - $150,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in building and maintaining detection systems and threat intelligence platforms, with a strong focus on automation and production readiness. Proficient in utilizing industry standards such as STIX and TAXII for effective data distribution and threat detection.

Highest-signal resume keywords

Python ProgrammingTypeScript/Node DevelopmentThreat Intelligence EngineeringSTIX 2.1 and TAXII 2.1 KnowledgeYARA and Sigma Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat IntelligenceDetection EngineeringData ParsingDetection Logic DevelopmentMalware AnalysisProduction Systems DevelopmentData Pipeline ManagementCloud InfrastructureCI/CD PipelinesStreaming and Batch Data Platforms

Tools & Technologies

AWSContainersRelational Data StoresCache Data StoresMISPMITRE ATT&CK

Industry Keywords

OSINT IngestionSandbox OrchestrationFederated Sharing EndpointsBehavioral IndicatorsResearch Output

Tech Stack

Tools & technologies

AWSCloudCyber SecurityNode.jsPythonTypeScript

About the role

Key responsibilities & impact

Own the path from research output to production-ready artifact: a detection rule, a distributed feed, a scoring input, or a customer alert.
Build and maintain STRIKE platform components across multiple services and runtimes, including distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines that operate over standards-anchored predicates.
Turn research into shipped detection content: YARA, Sigma, STIX patterns, behavioral indicators, and the pipelines that distribute them.
Drive STIX 2.1 adoption as a unified output schema and TAXII 2.1 as a distribution standard.
Build the automation that removes commodity overhead from research work: indicator enrichment, report drafting, corpus correlation, feed normalization, and sandbox triage.
Coordinate with engineering, measurement, and platform product teams so research actually lands in product.

Requirements

What you’ll need

Bachelor's or Master's in Computer Science, Cybersecurity, or a related technical field
5 to 8 years in a hands-on engineering role with meaningful exposure to threat intelligence, security research, or detection engineering
Prior experience building production systems that consume or emit threat intel data is required.
Python and TypeScript/Node at a production level
Relational and cache data stores, plus at least one streaming or batch data platform
Cloud infrastructure (AWS preferred), containers, and CI/CD pipelines
Working knowledge of STIX 2.1, TAXII 2.1, MISP, and MITRE ATT&CK, and how they work together in practice
Hands-on experience with YARA, Sigma, and STIX Patterning
Comfortable reading malware analysis output, parsing adversary infrastructure data, and writing detection logic that holds up under production load.

Benefits

Comp & perks

Specific to each country, we offer a competitive salary
stock options
Health benefits
unlimited PTO
parental leave
tuition reimbursements