Threat Intelligence Researcher

Job Application for Threat Intelligence Researcher at SecurityScorecard Back to jobs New Threat Intelligence Researcher Remote (US) Apply Here About SecurityScorecard: SecurityScorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Alex Yampolskiy and Sam Kassoumeh and funded by world-class investors, SecurityScorecard’s patented rating technology is used by over 25,000 organizations for self-monitoring, third-party risk management, board reporting, and cyber insurance underwriting; making all organizations more resilient by allowing them to easily find and fix cybersecurity risks across their digital footprint. Headquartered in New York City, our culture has been recognized by Inc Magazine as a "Best Workplace,” by Crain’s NY as a "Best Places to Work in NYC," and as one of the 10 hottest SaaS startups in New York for two years in a row. Most recently, SecurityScorecard was named to Fast Company’s annual list of the World’s Most Innovative Companies for 2023 and to the Achievers 50 Most Engaged Workplaces in 2023 award recognizing “forward-thinking employers for their unwavering commitment to employee engagement.” SecurityScorecard is proud to be funded by world-class investors including Silver Lake Waterman, Moody’s, Sequoia Capital, GV and Riverwood Capital. About the Role: You'll be joining SecurityScorecard's threat research team as its intelligence-focused practitioner, working alongside deep technical researchers to produce timely, actionable intelligence for customers, partners, and internal stakeholders. Where the Threat Researcher role is anchored in technical analysis, this role sits at the intersection of research and communication — you'll be tracking threat actors and their infrastructure, producing intelligence reports, and translating complex findings into clear, credible content for a range of audiences. Marketing is currently one of the team's primary stakeholders, and you'll work closely with them on research-driven content and campaigns — but the team's ambition is to become a resource for every division in the company, and you'll be part of building that reputation. Customer briefings, coordinated threat actor takedowns, and participation in industry events are all part of the mandate. Strong written and spoken English is essential, as is the ability to represent the team's work credibly in external settings. This is a role for someone who combines analytical depth with the communication skills to make that work land. Key Responsibilities: Deep Technical Research and Tracking: Identify, track, and analyze advanced persistent threats (APTs), their TTPs, and their live infrastructure to gain insights into attack vectors, victimology, and attack scale. Intelligence Briefing and Reporting: Produce timely and actionable intelligence reports for customers, press, and partners. Participate in customer briefings, incident mitigation, and coordinated threat actor (TA) takedowns. Detection Engineering: Develop and maintain high-fidelity detection signatures (YARA, Snort, Sigma) to protect customers. Hunting and Monitoring: Query massive datasets (using SQL, Python, or Splunk) to identify anomalies and map out adversary infrastructure. Build workbooks, dashboards, and develop methodologies to improve detections. AI and LLM Automation: Design and leverage AI and LLM automations to support your analysis workload. Qualifications: Education: Bachelor's or Master's in Computer Science, Cybersecurity, or a highly technical equivalent. Experience: 3–5 years in a hands-on threat intelligence research role within a prominent industry organization, military, law enforcement, or government. Knowledge: Familiarity with prominent threat actors, APTs, emerging threat vectors, and the wider threat landscape. Technical Skills: Proficiency with large dataset querying and dashboard design using Splunk, SQL, or similar platforms. Mindset: A hacker's curiosity — the ability to look at a data point and see the hidden pattern. Bonus: Experience with open source and commercial attack surface, malware analysis, and network intelligence tools and platforms. Additional Bonus: Native-level reading and writing proficiency in Russian, Mandarin, Korean, or Farsi. Benefits: Specific to each country, we offer a competitive salary, stock options, Health benefits, and unlimited PTO, parental leave, tuition reimbursements, and much more! The estimated total compensation range for this position is $100,000 - $120,000 (base plus bonus). Actual compensation for the position is based on a variety of factors, including, but not limited to affordability, skills, qualifications and experience, and may vary from the range. In addition to base salary, employees may also be eligible for annual performance-based incentive compensation awards and equity, among other company benefits. SecurityScorecard is committed to Equal Employment Opportunity and embraces diversity. We believe that our team is strengthened through hiring and retaining employees with diverse backgrounds, skill sets, ideas, and perspectives. We make hiring decisions based on merit and do not discriminate based on race, color, religion, national origin, sex or gender (including pregnancy) gender identity or expression (including transgender status), sexual orientation, age, marital, veteran, disability status or any other protected category in accordance with applicable law. We also consider qualified applicants regardless of criminal histories, in accordance with applicable law. We are committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need assistance or accommodation due to a disability, please contact . Any information you submit to SecurityScorecard as part of your application will be processed in accordance with the Company’s privacy policy and applicable law. SecurityScorecard does not accept unsolicited resumes from employment agencies. Please note that we do not provide immigration sponsorship for this position. #LI-DNI Create a Job Alert Interested in building your career at SecurityScorecard? Get future opportunities sent straight to your email. Create alert Apply for this job * indicates a required field Autofill with MyGreenhouse First Name * Last Name * Email * Phone Country * Phone * Location (City) * Locate me Resume/CV * Attach Attach Dropbox Google Drive Enter manually Enter manually Accepted file types: pdf, doc, docx, txt, rtf Cover Letter Attach Attach Dropbox Google Drive Enter manually Enter manually Accepted file types: pdf, doc, docx, txt, rtf Employment Company name Title Start date month Select... Start date year End date month Select... End date year Current role Add another Education School Select... Degree Select... Discipline Select... Add another LinkedIn Profile Salary expectations (base plus bonus) in USD? * Will you now or in the future require VISA sponsorship for employment status? * Select... Do you have a Bachelor's or Master's degree in Computer Science, Cybersecurity, or a technical equivalent? * Select... Do you have 3 or more years of hands-on threat intelligence research experience — not SOC analysis or incident response, but specifically tracking threat actors, their infrastructure, and their TTPs? * Select... Have you developed or maintained detection signatures (YARA, Snort, or Sigma) in a professional or research capacity? * Select... Do you have professional experience querying large datasets using Splunk, SQL, or a comparable platform to identify anomalies or map adversary infrastructure? * Select... Have you authored threat intelligence reports, briefings, or research publications intended for external audiences (customers, press, partners, or government)? * Select... What other languages (besides English) are you proficient in and to what degree? * Please provide samples of your work Attach Attach Dropbox Google Drive Accepted file types: pdf, doc, docx, txt, rtf You are tracking a financially motivated threat actor that has been targeting mid-market financial services firms in North America. Over the past two weeks your infrastructure monitoring has surfaced three new C2 domains, a shift in their tooling from a known commodity RAT to something you haven't seen attributed before, and a change in their initial access vector from phishing to exploiting a public-facing application. You've been asked to produce an intelligence report for three different audiences this week: your internal detection engineering team, a Fortune 500 customer who may be in the actor's target profile, and a press outlet covering a related breach story. Walk us through how you would approach this. What additional sources or data would you pull before writing anything? How does the structure and language of the report change across those three audiences? What would you include in each version and what would you deliberately leave out — and why? If the unattributed tooling turns out to be significant, at what threshold of confidence would you include attribution language versus flagging it as unconfirmed, and how would you communicate that uncertainty to a non-technical customer? * AI/LLM Usage: Which AI/LLM/agent tools have you used in the last 6 months? For each, note frequency (daily, weekly, occasional) and what you use it for. * AI/LLM Impact: Describe two specific examples where AI improved your work output (speed, quality, clarity, decision-making). Include what you were trying to do, what you asked the tool, and what changed as a result. * Voluntary Self-Identification For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file. As set forth in SecurityScorecard’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law. Gender Select... Are you Hispanic/Latino? Select... Race & Ethnicity Definitions If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows: A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability. A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service. An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense. An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985. Veteran Status Select... Voluntary Self-Identification of Disability Form CC-305 Page 1 of 1 OMB Control Number 1250-0005 Expires 04/30/2026 Why are you being asked to complete this form? We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years. Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at . How do you know if you have a disability? A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to: Alcohol or other substance use disorder (not currently using drugs illegally) Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS Blind or low vision Cancer (past or present) Cardiovascular or heart disease Celiac disease Cerebral palsy Deaf or serious difficulty hearing Diabetes Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders Epilepsy or other seizure disorder Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome Intellectual or developmental disability Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD Missing limbs or partially missing limbs Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS) Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities Partial or complete paralysis (any cause) Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema Short stature (dwarfism) Traumatic brain injury Disability Status Select... PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete. Submit application Powered by Greenhouse