--- title: 'Senior Research Engineer, Threat Intelligence at SecurityScorecard' canonical: 'https://feeny.ai/job/senior-research-engineer-threat-intelligence-securityscorecard-united-states-6xnyxk8ecb4a' type: 'job' last_seen: '2026-09-09' --- # Senior Research Engineer, Threat Intelligence at SecurityScorecard - **Company:** SecurityScorecard - **Location:** United States - **Work type:** remote - **Posted:** 2026-08-20 - **Last confirmed live:** 2026-09-09 - **Apply:** https://job-boards.greenhouse.io/securityscorecard/jobs/8146113 ## Job description About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Alex Yampolskiy and Sam Kassoumeh and funded by world-class investors, SecurityScorecard’s patented rating technology is used by over 25,000 organizations for self-monitoring, third-party risk management, board reporting, and cyber insurance underwriting; making all organizations more resilient by allowing them to easily find and fix cybersecurity risks across their digital footprint. Headquartered in New York City, our culture has been recognized by Inc Magazine as a "Best Workplace,” by Crain’s NY as a "Best Places to Work in NYC," and as one of the 10 hottest SaaS startups in New York for two years in a row. Most recently, SecurityScorecard was named to Fast Company’s annual list of the[World’s Most Innovative Companies for 2023](https://securityscorecard.com/blog/blog-top-innovators-of-the-year/) and to the Achievers 50 Most Engaged Workplaces in 2023 award recognizing “forward-thinking employers for their unwavering commitment to employee engagement.”  SecurityScorecard is proud to be funded by world-class investors including Silver Lake Waterman, Moody’s, Sequoia Capital, GV and Riverwood Capital. About the Role: You'll join STRIKE, SecurityScorecard's Threat Intelligence team, as the engineering counterpart to research. STRIKE runs several research motions in parallel, each on its own clock: rapid response to active events, longer product-tied work, and standards-anchored research on a quarterly cadence. The path from a finding to a shipped detection or feed gets reinvented every time. That's the problem this role is here to solve. You'll work directly with the senior technical leader who owns STRIKE's R&D direction, and report to the Head of Threat Research for people management. Technical direction comes from R&D leadership; you own delivery. You'll take a research artifact (a malware finding, an infrastructure cluster, a new indicator class, a behavioral pattern) and turn it into something the company can use without a second round of engineering: schemas, pipeline hooks, distribution feeds, detection rules, or platform APIs. This isn't a pure research role, and it isn't a pure platform role either. Researchers ideate, you ship. Key Responsibilities: Research-to-Production Pipeline - Own the path from research output to production-ready artifact: a detection rule, a distributed feed, a scoring input, or a customer alert. Partner with adjacent teams to define clean handoff contracts, so new signals arrive downstream with the schema, value framing, and consumption pattern already defined. Threat Intelligence Platform Engineering - Build and maintain STRIKE platform components across multiple services and runtimes, including distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines that operate over standards-anchored predicates. Extend these systems without breaking the data contracts already in production. Detection Content and Signal Production - Turn research into shipped detection content: YARA, Sigma, STIX patterns, behavioral indicators, and the pipelines that distribute them. Build correlation pipelines that link scan data, attack surface signals, vulnerability data, and adversary tracking into customer-facing intelligence. Data Model and Standards Adoption - Drive STIX 2.1 adoption as a unified output schema and TAXII 2.1 as a distribution standard. Define and govern schemas that hold up once they reach downstream teams. Research Workflow Engineering - Build the automation that removes commodity overhead from research work: indicator enrichment, report drafting, corpus correlation, feed normalization, and sandbox triage. Help move the team from analyst-driven, model-assisted workflows toward model-driven workflows with analyst review. - The work that matters most here is often the unglamorous part: retrieval grounded in the team's own corpus so outputs cite sources rather than model priors, schema-constrained output so a generated indicator is a valid one, and eval harnesses that catch regressions before analysts do. Cost accounting, latency budgeting, prompt versioning, and output logging round out the infrastructure that makes a workflow safe to run unattended. - You should have a clear sense of when a model is the wrong tool. A regex beats a model for known patterns; a SQL query beats a model for structured data. Knowing where that line sits, and respecting it, is part of the job. Cross-Functional Delivery - Coordinate with engineering, measurement, and platform product teams so research actually lands in product. You'll often serve as the engineering voice translating between researchers, product managers, and platform engineers, and you may occasionally explain the work to customers, journalists, or executives. ## Qualifications Education: Bachelor's or Master's in Computer Science, Cybersecurity, or a related technical field. Self-taught practitioners with strong public work are welcome. Experience: 5 to 8 years in a hands-on engineering role with meaningful exposure to threat intelligence, security research, or detection engineering. Prior experience building production systems that consume or emit threat intel data is required. Technical Skills: - Python and TypeScript/Node at a production level - Relational and cache data stores, plus at least one streaming or batch data platform - Cloud infrastructure (AWS preferred), containers, and CI/CD pipelines - Working knowledge of STIX 2.1, TAXII 2.1, MISP, and MITRE ATT&CK, and how they work together in practice Detection and Research Tooling: Hands-on experience with YARA, Sigma, and STIX Patterning. Comfortable reading malware analysis output, parsing adversary infrastructure data, and writing detection logic that holds up under production load. Applied Language Models: You've shipped production systems that use language models, not just demos. That includes retrieval over a real corpus, structured output with schema validation, eval harnesses that catch regressions before users do, and a solid understanding of where models fail: recency, long-tail facts, numerical reasoning, and adversarial input or prompt injection. You can do the cost-per-task math for your workloads, and you can make the case when a smaller, tightly scaffolded model beats a larger one. You approach model output with healthy skepticism by default. The bar for shipping a model-generated indicator or detection is higher than for shipping a regex, and you understand why and design accordingly. Bridge Mindset: You write code that ships, and you understand why researchers think the way they do. If you've only ever worked from a backlog handed down by a product manager, this probably isn't the right fit. If you've taken an idea sketched out in a chat message and turned it into a deployed pipeline before the next sprint began, that's the mode we're looking for. Bonus: - Experience with policy-as-code or expression-language engines (CEL, OPA, or similar) - Published or co-authored security research (campaigns, vulnerabilities, adversary tracking) - Large-scale telemetry experience (Splunk, Kinesis, NetFlow, or equivalent) - Contributor or maintainer on open-source threat intel projects (MISP, OpenCTI, Sigma, STIX, ATT&CK) - Familiarity with quantitative risk frameworks such as FAIR - Familiarity with Golang at a production level Benefits: Specific to each country, we offer a competitive salary, stock options, Health benefits, and unlimited PTO, parental leave, tuition reimbursements, and much more! The estimated total compensation range for this position is $140,00 - $180,000 (base plus bonus). Actual compensation for the position is based on a variety of factors, including, but not limited to affordability, skills, qualifications and experience, and may vary from the range. In addition to base salary, employees may also be eligible for annual performance-based incentive compensation awards and equity, among other company benefits. SecurityScorecard is committed to Equal Employment Opportunity and embraces diversity. We believe that our team is strengthened through hiring and retaining employees with diverse backgrounds, skill sets, ideas, and perspectives. We make hiring decisions based on merit and do not discriminate based on race, color, religion, national origin, sex or gender (including pregnancy) gender identity or expression (including transgender status), sexual orientation, age, marital, veteran, disability status or any other protected category in accordance with applicable law. We also consider qualified applicants regardless of criminal histories, in accordance with applicable law. We are committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need assistance or accommodation due to a disability, please contact talentacquisitionoperations@securityscorecard.io. Any information you submit to SecurityScorecard as part of your application will be processed in accordance with the Company’s privacy policy and applicable law. SecurityScorecard does not accept unsolicited resumes from employment agencies.  Please note that we do not provide immigration sponsorship for this position.   #LI-DNI ## About SecurityScorecard ## Company Overview - **One-liner**: SecurityScorecard is the global leader in threat-informed third-party risk management (TPRM) and supply chain detection and response, providing continuous cybersecurity ratings and intelligence for millions of organizations. - **Entity Type**: Private (funded by world-class investors; multiple rounds) - **Headquarters**: New York City, New York, USA (with global offices in Uruguay, Prague, Romania, London) - **Founded**: 2013 - **Founders**: Dr. Alex Yampolskiy and Sam Kassoumeh ## Core Business - **Primary industry**: Cybersecurity – third-party risk management, supply chain security, threat intelligence, and cyber insurance underwriting. - **Target customers**: B2B – enterprise organizations including 70% of the Fortune 100, insurance carriers, and mid-market firms. - **Mission**: “To make the world a safer place by transforming the way organizations understand, mitigate, and communicate cybersecurity risk to their boards, employees, and vendors.” ## Products & Services - **TITAN AI Platform**: An AI-powered, threat-informed TPRM platform that unifies real-time threat intelligence, automated assessments, continuous monitoring, and remediation workflows. Includes AI agents (e.g., ChatSSC) to automate tasks like portfolio analysis and reporting. - **Security Ratings**: The industry’s benchmark “A” through “F” grading system for cybersecurity health, used for self-monitoring, vendor oversight, and board reporting. - **Third-Party Risk Management (TPRM)**: Continuous vendor monitoring, automated risk assessments, and compliance mapping (DORA, SEC rules, etc.) on a single platform. - **Cyber Insurance**: Risk evaluation tools that help insurers assess and manage insurability, claims, and proactive risk reduction. - **Security Questionnaires**: AI-accelerated sending, receiving, and auto-filling of security questionnaires (claims 92% reduction in manual effort). - **Threat Intelligence**: Unified, real-time threat intelligence from proprietary data and the acquisition of Driftnet (May 2026) for high-fidelity internet scanning. ## Market Standing - **Valuation/Market Cap**: Not publicly disclosed (private company). - **Key Metric**: Over **12 million** organizations continuously rated; **3,300+** global organizations use the platform; **70%** of the Fortune 100 trust SecurityScorecard data. - **Notable Investors**: Silver Lake Waterman, Moody’s Corporation, Sequoia Capital, GV (Google Ventures), Riverwood Capital. - **Growth Signals**: - Acquired Driftnet in May 2026 to power real-time threat-informed TPRM. - Named to Fast Company’s “World’s Most Innovative Companies” and Inc. Magazine’s “Best Workplace.” - Recognized as one of the 10 hottest SaaS startups in New York (two consecutive years). - Actively migrating legacy products onto the next-generation TITAN platform with an AI-first engineering transformation. ## Competitive Advantages - **Data Ownership**: SecurityScorecard owns **99% of its data**, ensuring near-zero latency, superior attribution, and the highest quality telemetry vs. competitors that rely on third-party snapshots. - **Threat-Informed TPRM**: Correlates the industry’s largest risk dataset with active threat intelligence to identify vulnerabilities that are actually being weaponized, not just compliance gaps. - **AI-Accelerated Workflows**: AI agents, automated questionnaires, and remediation planning reduce manual effort by up to 75% and speed up questionnaire processing by 18x. - **Industry Standard Benchmark**: The A-F rating system is widely adopted by Fortune 100 firms, regulators, and insurers as a de facto measure of cyber health. ## Strategic Focus - **AI-First Platform Evolution**: Driving every product toward agentic, AI-assisted workflows (TITAN AI, TITAN Agents) and migrating the entire product suite onto the TITAN platform. - **Supply Chain Resilience**: Expanding real-time detection and response capabilities across extended supply chains through acquisitions and organic innovation. - **Regulatory Compliance**: Helping organizations meet global regulations (DORA, SEC, etc.) with evidence-based, continuous monitoring and automated reporting. ## Why Work Here - **Culture & Recognition**: Rated a “Best Workplace” by Inc. Magazine and a “Best Places to Work in NYC” by Crain’s. Named to Achievers 50 Most Engaged Workplaces. Emphasizes collaboration, innovation, and fun (in-person culture at NYC HQ). - **Remote-First Flexibility**: Remote-friendly organization with global team members across EMEA (Prague, Romania, London) and the US. Headquarters in New York City for in-person engagement. - **Benefits** (US-focused): Unlimited PTO, medical/dental/vision from day one, stock options for full-time employees, 401k, annual education stipend, referral bonuses, and a recognition rewards program. - **Engineering Culture**: Heavy investment in AI transformation — building with agentic AI, modernizing data infrastructure, and working on high-impact security workflows. Teams span EMEA to US West Coast (40–50 engineers per vertical). Leadership role posted for Head of Engineering with compensation range $260k–$320k (base + bonus) plus equity. - **Diversity & Inclusion**: Committed to promoting a diverse workforce, global perspectives, and inclusive culture. Actively participates in charitable initiatives (e.g., breast cancer fundraising). ## Sources 1. [securityscorecard.com – About](https://securityscorecard.com/company/) 2. [securityscorecard.com – Careers](https://securityscorecard.com/company/careers/) 3. [securityscorecard.com – Culture](https://securityscorecard.com/company/culture/) 4. [Greenhouse – Head of Engineering Job Posting](https://job-boards.greenhouse.io/securityscorecard/jobs/7967900) 5. [securityscorecard.com – Product Pages (TPRM, Cyber Insurance, etc.)](https://securityscorecard.com/) ## Other roles at SecurityScorecard - [Senior Forward Deployed Engineer](https://feeny.ai/job/senior-forward-deployed-engineer-securityscorecard-united-states-xqjcftb7xawk) — United States - [Business Development Representative](https://feeny.ai/job/business-development-representative-securityscorecard-portugal-e65athvsjbvx) — Portugal - [Senior Customer Success Manager](https://feeny.ai/job/senior-customer-success-manager-securityscorecard-united-states-vge48wees9ms) — United States - [Senior Customer Success Manager](https://feeny.ai/job/senior-customer-success-manager-securityscorecard-new-york-95681hntdt54) — New York, NY - [Country Manager, Japan](https://feeny.ai/job/country-manager-japan-securityscorecard-japan-bdfe3m2j4rb0) — Japan - [Senior UX Manager](https://feeny.ai/job/senior-ux-manager-securityscorecard-united-states-y4jw8e1fz9da) — United States - [Senior UX Manager](https://feeny.ai/job/senior-ux-manager-securityscorecard-austin-pt1758xzpmay) — Austin, TX - [GTM Engineer](https://feeny.ai/job/gtm-engineer-securityscorecard-austin-c9dp8sfc4bvq) — Austin, TX - [GTM Engineer](https://feeny.ai/job/gtm-engineer-securityscorecard-united-states-eenftgdb4dsg) — United States - [GTM Engineer](https://feeny.ai/job/gtm-engineer-securityscorecard-new-york-qg2rr7mbbgz9) — New York, NY