Senior Threat Intelligence Engineer — Remote, High Impact

Coalition, Inc.; United States; Remote; USD 75,000 - 134,000; Full time

Benefits offered by this job

Medical coverage

Flexible PTO

Home office stipend

WeWork access

Wellness programs

Job summary

Coalition, Inc. is seeking a Threat Intelligence professional to lead the Zero-Day Alert process, develop detections, honeypots, and original intelligence for Coalition’s Active Insurance platform.

You’ll collaborate across Security, Underwriting, Incident Response, Product, and Data Engineering in a remote-first environment. The role emphasizes writing meaningful security signals, researching vulnerabilities under time pressure, and communicating findings to technical and non-technical

Qualifications

• 5+ years in threat intelligence, vulnerability research, or related security engineering.
• Experience translating vulnerabilities into enterprise risk insights.
• Strong Python and SQL skills; ability to write detectors and signatures.

Responsibilities

• Drive the Zero-Day Alert process from triage to policyholder notification.
• Coordinate urgent outreach with Security, Underwriting and Incident Response.
• Write and refine detection rules, signatures, and telemetry-derived risk signals.
• Maintain and expand honeypot networks; analyze exploitation telemetry.
• Improve detection accuracy using claims insights and external data sets.
• Publish advisories and security research to inform decisions.
• Participate in on-call rotation for emergencies.

Skills

Threat intel

Vulnerability research

Pen testing

Defensive security

Network protocols

Operating systems

Web apps

Python

SQL

Documentation

Communication

Tools

Regex

Scripting

Job description

Coalition, Inc. is seeking a Threat Intelligence professional to lead the Zero-Day Alert process, develop detections, honeypots, and original intelligence for Coalition’s Active Insurance platform.

You’ll collaborate across Security, Underwriting, Incident Response, Product, and Data Engineering in a remote-first environment. The role emphasizes writing meaningful security signals, researching vulnerabilities under time pressure, and communicating findings to technical and non-technical