Own the path from research output to production-ready artifact: a detection rule, a distributed feed, a scoring input, or a customer alert
Build and maintain STRIKE platform components across multiple services and runtimes
Turn research into shipped detection content: YARA, Sigma, STIX patterns, behavioral indicators, and the pipelines that distribute them
Drive STIX 2.1 adoption as a unified output schema and TAXII 2.1 as a distribution standard
Build the automation that removes commodity overhead from research work
Coordinate with engineering, measurement, and platform product teams so research actually lands in product

Bachelor's or Master's in Computer Science, Cybersecurity, or a related technical field
5 to 8 years in a hands-on engineering role with meaningful exposure to threat intelligence, security research, or detection engineering
Prior experience building production systems that consume or emit threat intel data is required
Python and TypeScript/Node at a production level
Relational and cache data stores, plus at least one streaming or batch data platform
Cloud infrastructure (AWS preferred), containers, and CI/CD pipelines
Working knowledge of STIX 2.1, TAXII 2.1, MISP, and MITRE ATT&CK, and how they work together in practice
Hands-on experience with YARA, Sigma, and STIX Patterning
Experience with policy-as-code or expression-language engines (CEL, OPA, or similar) (Bonus)
Published or co-authored security research (campaigns, vulnerabilities, adversary tracking) (Bonus)

Senior Research Engineer, Threat Intelligence

Key skills