Senior Threat Intelligence Engineer

This is a fully remote position, open to applicants in Canada.

📋 Description

• Detect and analyze emerging vulnerabilities and exploitation activities before they result in losses for policyholders.

• Oversee critical components of the Zero-Day Alert process, developing detections, honeypots, and first-party threat intelligence.

• Manage the Zero-Day Alert process from the triage of vulnerabilities to the actionable notification of policyholders.

• Facilitate prompt communication with the Security Support Center, Underwriting, and Incident Response for high-severity or actively exploited vulnerabilities.

• Create and enhance technology fingerprints, detection rules, and security findings that convert scan data into dependable risk signals.

• Sustain and grow the distributed honeypot network, examining telemetry for exploitation and emerging adversarial techniques.

• Enhance detection precision and decrease false positives through insights from claims, external datasets, and vulnerability research.

• Issue advisories, conduct research, and prepare briefings that guide security decision-making.

• Engage in the on-call rotation for urgent notifications.

• Collaborate across Security, Underwriting, Incident Response, Product, and Data Engineering teams.

⛳️ Requirements

• Over 5 years of experience in threat intelligence, vulnerability research, penetration testing, or defensive security engineering.

• In-depth understanding of network protocols, operating systems, web applications, and exploitation techniques (RCE, authentication bypass, edge-device vulnerabilities).

• Proven ability to evaluate new vulnerabilities under time constraints and translate them into actionable enterprise risk.

• Practical experience in crafting scanner detections, signatures, or parsing scripts (Python, regex, protocol fingerprints).

• Familiarity with honeypots, deception technologies, or internet-wide scanning, along with other extensive security datasets.

• Proficient in Python and SQL.

• Strong communication skills tailored to both technical and non-technical audiences.

• Demonstrated history of clear documentation or public security writing, coupled with the capability to lead complex tasks independently.

• Bonus: Experience with tools such as Censys, Shodan, BinaryEdge, or attack surface mapping.

• Bonus: Skills in reverse engineering, patch diffing, or proof of concept exploit validation.

• Bonus: Knowledge of VPNs, firewalls, load balancers, or SCADA/ICS systems.

• Bonus: Contributions to public research, CVE credits, or presentations at conferences.

• Bonus: Understanding of cyber insurance, underwriting, or risk aggregation modeling.

🏝️ Benefits

• Comprehensive 100% coverage for medical, dental, and vision expenses.

• Flexible paid time off (PTO) policy.

• Annual stipend for home office setup and access to WeWork facilities.

• Wellness programs focused on mental and physical health, including resources like Headspace and Lumino.

• Competitive salary with opportunities for career advancement.

• Emphasis on a remote-first work culture.