Senior Research Engineer, Threat Intelligence

About the Role

You'll join STRIKE, SecurityScorecard's Threat Intelligence team, as the engineering counterpart to research. STRIKE runs several research motions in parallel, each on its own clock: rapid response to active events, longer product-tied work, and standards-anchored research on a quarterly cadence. The path from a finding to a shipped detection or feed gets reinvented every time. That's the problem this role is here to solve.

You'll work directly with the senior technical leader who owns STRIKE's R&D direction, and report to the Head of Threat Research for people management. Technical direction comes from R&D leadership; you own delivery. You'll take a research artifact (a malware finding, an infrastructure cluster, a new indicator class, a behavioral pattern) and turn it into something the company can use without a second round of engineering: schemas, pipeline hooks, distribution feeds, detection rules, or platform APIs.

This isn't a pure research role, and it isn't a pure platform role either. Researchers ideate, you ship.

Key Responsibilities

Research-to-Production Pipeline

• Own the path from research output to production-ready artifact: a detection rule, a distributed feed, a scoring input, or a customer alert. Partner with adjacent teams to define clean handoff contracts, so new signals arrive downstream with the schema, value framing, and consumption pattern already defined.

Threat Intelligence Platform Engineering

• Build and maintain STRIKE platform components across multiple services and runtimes, including distribution servers, sandbox orchestration, OSINT ingestion, federated sharing endpoints, agent runtimes, and rules engines that operate over standards-anchored predicates. Extend these systems without breaking the data contracts already in production.

Detection Content and Signal Production

• Turn research into shipped detection content: YARA, Sigma, STIX patterns, behavioral indicators, and the pipelines that distribute them. Build correlation pipelines that link scan data, attack surface signals, vulnerability data, and adversary tracking into customer-facing intelligence.

Data Model and Standards Adoption

• Drive STIX 2.1 adoption a