Research Engineer

Twenty; New York (NY); On-site; USD 159,000 - 263,000; Full time

Benefits offered by this job

Health, dental, and vision

Life / AD&D

Paid parental leave

401(k) with pre-tax and Roth options

Job summary

Twenty Technologies seeks a Research Engineer to translate adversary behavior into operational software. You will explore emerging techniques, build prototypes, and craft reusable tools for operators and analysts—integrating research with real mission needs.

Role requires 2–5 years in offensive cyber or security research, proficiency in Python or Go, and a background in cyber datasets and experimentation within government or defense contexts.

Qualifications

• 2–5 years in offensive cyber, security research, or software development with working tools.
• Hands-on gov/military cyber operations, pentesting, red team, or threat hunting.
• Proficiency in Python or Go and building maintainable security tooling.
• Experience analyzing cyber datasets using data-science methods.
• Understanding of adversary techniques, MITRE ATT&CK.
• Ability to investigate problems and communicate findings clearly.
• Degree in CS, software engineering, or cybersecurity, or equivalent.
• U.S. citizenship required; active clearance not required.

Responsibilities

• Research adversary techniques and translate findings into practical tools, prototypes and engineering requirements.
• Build reusable software for adversary emulation and attack-path analysis, with an emphasis on testing, maintainability and operational usefulness.
• Develop and evaluate technical approaches, explaining their tradeoffs and limitations.
• Analyze and enrich intelligence and operational datasets, including graph-based relationships, and work with data engineering to turn findings into reusable research capabilities.
• Collaborate with operators and analysts to identify gaps, validate results and incorporate feedback.
• Document findings and technical decisions, participate in code reviews, and contribute to reliable development practices.

Skills

Python

Go

Adversary emulation

Threat intelligence

Data analysis

Security tooling

MITRE ATT&CK

Education

CS / cybersecurity degree

Tools

Graph databases

Adversary-emulation platforms

Security tooling

Job description

About The Company

America is under sustained cyber attack. Our adversaries infiltrate our networks, steal our IP, and degrade the digital infrastructure that modern life runs on. They’ve learned—correctly—that those attacks rarely produce consequences.

About The Company

America is under sustained cyber attack. Our adversaries infiltrate our networks, steal our IP, and degrade the digital infrastructure that modern life runs on. They’ve learned—correctly—that those attacks rarely produce consequences. Twenty was founded to change that, by making our adversaries think twice before they attack us. Our vision is American and allied primacy in cyberspace—a future where they cannot contest us, deterrence is assured, and the free world remains secure. Founded in 2024, Twenty Technologies (www.twenty.io) industrializes offensive cyber operations for the U.S. and its allies. Headquartered in Arlington, Virginia, Twenty has raised $168M from Khosla Ventures, Accel, Caffeinated Capital, Friends & Family Capital, Point72 Ventures, General Catalyst, and In-Q-Tel.

Mission | On Site | Full Time | U.S. Citizenship Required / No Active Clearance Required

Role Summary

Twenty builds offensive cyber capabilities for the United States and its allies. We’re looking for a Research Engineer who can turn an understanding of adversary behavior into software that works in operational environments. You’ll investigate emerging techniques, build and test research prototypes, and develop reusable tools that help operators understand and exercise complex attack paths. Working with research, engineering and operational teams, you’ll connect technical research to real mission needs and carry promising ideas through implementation.

What You’ll Do

• Research adversary techniques and translate findings into practical tools, prototypes and engineering requirements.
• Build reusable software for adversary emulation and attack-path analysis, with an emphasis on testing, maintainability and operational usefulness.
• Develop and evaluate technical approaches, explaining their tradeoffs and limitations.
• Analyze and enrich intelligence and operational datasets, including graph-based relationships, and work with data engineering to turn findings into reusable research capabilities.
• Collaborate with operators and analysts to identify gaps, validate results and incorporate feedback.
• Document findings and technical decisions, participate in code reviews, and contribute to reliable development practices.

Must Have

• 2–5 years of relevant experience in offensive cyber, security research or software development, including building working tools.
• Hands-on experience in at least one of government or military cyber operations, penetration testing or red teaming, or threat hunting and intelligence.
• Proficiency in Python or Go and experience building maintainable security tooling or automation.
• Experience analyzing and combining cyber or threat-intelligence datasets, using data-science techniques to test hypotheses and build useful analytical tools.
• An understanding of adversary techniques, network and application security, and frameworks such as MITRE ATT&CK.
• The ability to investigate unfamiliar problems, test hypotheses and communicate both evidence and limitations.
• The ability to explain technical findings to engineers, analysts and operators.
• A degree in computer science, software engineering or cybersecurity, or equivalent practical experience.
• U.S. citizenship is required. An active security clearance is not required.

Nice to Have

• Experience in Digital Network Exploitation Analysis or Exploitation Analysis.
• Experience developing tools or producing research adopted by operational users.
• Experience with custom security tooling or adversary-emulation platforms.
• Experience with graph databases, graph queries, or multi-source intelligence analysis.
• Experience in reverse engineering, vulnerability research, malware analysis, or exploit development.
• Experience applying AI or machine learning to security research.
• Relevant certifications or contributions through published research, open-source projects, or technical talks.

Benefits

What's on the table:

• Health. Medical, dental, and vision plan options. Life / AD&D, disability coverage options.
• Family. Paid parental leave for eligible full-time employees. 12 weeks for birthing parents, 4 for non-birthing parents, 6 weeks for adoptive, foster, or intended parents through surrogacy.
• Vacation. Paid holidays and flexible PTO. Take what you need.
• Retirement. 401(k) with pre-tax and Roth options. HSA/FSA options, dependent care FSA.

Benefits vary by location, role, and eligibility. Full plan details provided during the interview and offer process.

Due to U.S. government contract and security requirements, this role is limited to U.S. citizens. Some positions may also require eligibility to obtain and maintain a U.S. Government security clearance. Any active clearance requirement will be listed in the role description.

Twenty is an equal opportunity employer. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, veteran status, disability, or any other protected status, consistent with applicable law.

If you need a reasonable accommodation during the hiring process, let us know and we will work with you.

Compensation Range: $159K - $263K