Senior Research Engineer, Threat Intelligence

Security Scorecard is the global leader in cybersecurity ratings, with over 12 million companies continuously rated, operating in 64 countries. Founded in 2013 by security and risk experts Dr. Alex Yampolskiy and Sam Kassoumeh and funded by world‑class investors, Security Scorecard’s patented rating technology is used by over 25,000 organizations for self‑monitoring, third‑party risk management, board reporting, and cyber insurance underwriting;

making all organizations more resilient by allowing them to easily find and fix cybersecurity risks across their digital footprint.

Headquartered in New York City, our culture has been recognized by Inc Magazine as a "Best Workplace," by Crain’s NY as a "Best Places to Work in NYC," and as one of the 10 hottest SaaS startups in New York for two years in a row. Most recently, Security Scorecard was named to Fast Company’s annual list of the World’s Most Innovative Companies for 2023 and to the Achievers 50 Most Engaged Workplaces in 2023 award recognizing “forward‑thinking employers for their unwavering commitment to employee engagement.”

Security Scorecard is proud to be funded by world‑class investors including Silver Lake Waterman, Moody’s, Sequoia Capital, GV and Riverwood Capital.

You’ll join STRIKE, Security Scorecard's Threat Intelligence team, as the engineering counterpart to research. STRIKE runs several research motions in parallel, each on its own clock: rapid response to active events, longer product‑tied work, and standards‑anchored research on a quarterly cadence. The path from a finding to a shipped detection or feed gets reinvented every time. That’s the problem this role is here to solve.

You’ll work directly with the senior technical leader who owns STRIKE's R&D direction, and report to the Head of Threat Research for people management. Technical direction comes from R&D leadership; you own delivery. You’ll take a research artifact (a malware finding, an infrastructure cluster, a new indicator class, a behavioral pattern) and turn it into something the company can use without a second round of engineering: schemas, pipeline hooks, distribution feeds, detection rules, or platform APIs.

This isn’t a pure research role, and it isn’t a pure platform role either. Researchers ideate, you ship.

• Own the path from research output to production‑ready artifact: a detection rule, a distributed feed, a scoring input, or a customer alert. Partner with adjacent teams to define clean handoff contracts, so new signals arrive downstream with the schema, value framing, and consumption pattern already defined.
• Build and maintain STRIKE platform components across multiple services and runtimes, including distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines that operate over standards‑anchored predicates. Extend these systems without breaking the data contracts already in production.

• Turn research into shipped detection content: YARA, Sigma, STIX patterns, behavioral indicators, and the pipelines that distribute them. Build correlation pipelines that link scan data, attack surface signals, vulnerability data, and adversary tracking into customer‑facing intelligence.

• Drive STIX 2.1 adoption as a unified output schema and TAXII 2.1 as a distribution standard. Define and govern schemas that hold up once they reach downstream teams.

• Build the automation that removes commodity overhead from research work: indicator enrichment, report drafting, corpus correlation, feed normalization, and sandbox triage. Help move the team from analyst‑driven, model‑assisted workflows toward model‑driven workflows with analyst review.
• The work that matters most here is often the unglamorous part: retrieval grounded in the team’s own corpus so outputs cite sources rather than model priors, schema‑constrained output so a generated indicator is a valid one, and eval harnesses that catch regressions before analysts do. Cost accounting, latency budgeting, prompt versioning, and output…