Remote Threat Intelligence Engineer — Zero-Day Detection Lead

Coalition; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

Home office stipend

WeWork access

Wellness programs

Competitive compensation

Job summary

Coalition, the world’s first Active Insurance provider, seeks a seasoned Threat Intelligence professional to join its team. You’ll identify vulnerabilities, build detections and honeypots, and drive the Zero-Day Alert process across Security, Underwriting, Incident Response, Product, and Data Engineering.

You’ll translate complex vulnerability data into actionable risk signals, write robust signatures and scripts, and mentor others while working in a remote-first culture that values

Qualifications

• 5+ years in threat intelligence, vulnerability research, pen testing, or defensive security engineering.
• Deep knowledge of network protocols, operating systems, web apps, and exploitation.
• Experience assessing new vulnerabilities under time pressure and translating them into enterprise risk.
• Hands-on experience writing scanner detections, signatures, or parsing scripts (Python, regex, protocol fingerprints).
• Experience with honeypots, deception tech, or internet-wide scanning and other large security datasets.
• Strong Python and SQL skills.
• Excellent communication with both technical and non-technical audiences.
• Track record of clear documentation or public security writing, and ability to lead complex work independently.

Responsibilities

• Drive the Zero-Day Alert process from vulnerability triage to actionable policyholder notification.
• Coordinate urgent outreach with the Security Support Center, Underwriting, and Incident Response for high-severity or actively exploited vulnerabilities.
• Write and refine technology fingerprints, detection rules, and security findings that turn scan data into reliable risk signals.
• Maintain and expand the distributed honeypot network, analyzing telemetry for exploitation and new adversary techniques.
• Improve detection accuracy and reduce false positives using claims insights, external datasets, and vulnerability research.
• Publish advisories, research, and briefings that inform security decisions.
• Participate in the on-call rotation for emergency notifications.

Skills

Threat intelligence

Vulnerability research

Penetration testing

Defensive security engineering

Python

SQL

Communication

Documentation

Independent leadership

Tools

Honeypots

Deception tech

Scanning datasets

Job description

Coalition, the world’s first Active Insurance provider, seeks a seasoned Threat Intelligence professional to join its team. You’ll identify vulnerabilities, build detections and honeypots, and drive the Zero-Day Alert process across Security, Underwriting, Incident Response, Product, and Data Engineering.

You’ll translate complex vulnerability data into actionable risk signals, write robust signatures and scripts, and mentor others while working in a remote-first culture that values