Cybersecurity Practitioner: Paid Expert Interviews (SOC, Incident Response, Detection, AppSec)

DigiNo; Northern (KY); Hybrid; USD 41,000 - 83,000; Full time

Job summary

Mercor is conducting a short paid research engagement with hands-on security practitioners. You will join two to three one-hour video conversations over about four weeks, scheduled around your availability.

This remote, US-based opportunity focuses on how your daily work is performed and measured in enterprise security. Experience with EDR and SIEM stacks is a plus, and security leaders close to the work are welcome.

Qualifications

• Hands-on enterprise security experience is required.
• Familiarity with SOC workflow, triage and incident response appreciated.
• Experience with EDR/SIEM stacks is a plus.

Responsibilities

• Participate in one-hour video conversations with Mercor team.
• Discuss real-world work patterns, tooling, and decision points.

Skills

SOC analysts

Incident responders

Threat hunters

Security engineers

Tools

EDR

SIEM

CrowdStrike

Defender/Sentinel

Splunk

SentinelOne

Elastic

Job description

About the work

Mercor is designing a benchmark that measures how well AI agents do real enterprise cyber defense work. Before we build it, we want to hear from people who do that work every day.

This is a short paid research engagement, not a task or data project. You will join two to three one-hour video conversations with the Mercor team over roughly four weeks, scheduled around your availability.

What we will talk about

• How your work actually happens: the tools you live in, what lands in your queue, where judgment matters and where it does not.
• How your team measures whether a triage, investigation, containment, hunt, detection rule or patch was done well.
• Where AI assistance helps you today, where it gets in the way, and what would make a benchmark of AI on this work credible to you.
• Our draft task taxonomy: what is missing, what is mislabeled, what you would weight differently.

Who we are looking for

Current or recent hands-on practitioners in enterprise security, for example:

• SOC analysts and SOC leads (tier 2 and above)
• Incident responders and digital forensics investigators
• Detection engineers and threat hunters
• Application security or product security engineers who find and fix vulnerabilities in production code
• Security engineers who have run or been on the receiving end of a red team engagement

Experience with an EDR and SIEM stack (CrowdStrike Falcon, Microsoft Defender and Sentinel, Splunk, SentinelOne, Elastic or similar) is a plus. Security leaders are welcome if you are still close to the work.

Pay and time

• Paid hourly for interview time as a spot bonus. Sessions are one hour; no prep is expected.
• Two to three sessions in total. Nothing to build, label or submit.
• Remote, US-based.

Confidentiality

We will ask you to describe patterns, not specific incidents, and to leave out anything confidential about current or former employers or customers. Your input is used only to design the benchmark and is never attributed to you or your employer.