Threat Intelligence Engineer

Coalition, Inc.; United States; Remote; USD 140,000 - 220,000; Full time

Benefits offered by this job

Home office stipend

WeWork access

Wellness programs

Flexible PTO

Medical coverage

Dental coverage

Vision coverage

Job summary

Coalition, Inc. is seeking a Threat Intelligence professional to lead detection and alerting for zero-day vulnerabilities.

You will build detections, honeypots, and first‑party threat intelligence across Security, Underwriting, Incident Response, Product, and Data Engineering, coordinating across teams to protect policyholders. The role requires deep expertise in threat intelligence, vulnerability research, and rapid risk assessment, with strong Python and SQL abilities and a track record of

Qualifications

• 5+ years in threat intelligence, vulnerability research, pen testing, or defensive security engineering.
• Deep knowledge of networks, OS, web apps, and exploitation.
• Experience translating vulnerabilities into practical enterprise risk under time pressure.
• Hands-on experience writing scanner detections, signatures, or parsing scripts.
• Experience with honeypots or internet-wide scanning and large security datasets.
• Strong Python and SQL skills.
• Excellent communication with technical and non-technical audiences.
• Track record of clear documentation or public security writing.

Responsibilities

• Drive the Zero-Day Alert process from vulnerability triage to policyholder notification.
• Coordinate urgent outreach with Security Support Center, Underwriting, and Incident Response for high-severity vulnerabilities.
• Write and refine technology fingerprints, detection rules, and security findings from scan data.
• Maintain and expand the distributed honeypot network and analyze telemetry for exploitation.
• Improve detection accuracy and reduce false positives using claims data and vulnerability research.
• Publish advisories, research, and briefings to inform security decisions.
• Participate in on-call rotation for emergency notifications.

Skills

Threat intel

Vulnerability research

Pen testing

Defensive security

Python

SQL

Communications

Documentation

Threat intel tools

Tools

Censys

Shodan

BinaryEdge

Regex

HTTP fingerprinting

Job description

Описание:

Coalition is the world's first Active Insurance provider designed to help prevent digital risk before it strikes. Founded in 2017, Coalition combines comprehensive insurance coverage and innovative cybersecurity tools to help businesses manage and mitigate potential cyberattacks. Opportunities to make an impact with bold thinking are real—and happening daily at Coalition. Join Coalition’s Threat Intelligence team to identify emerging vulnerabilities and exploitation activity before they cause loss for policyholders. You’ll lead key parts of the Zero-Day Alert process and build the detections, honeypots, and first-party threat intelligence behind Coalition’s Active Insurance platform, working across Security, Underwriting, Incident Response, Product, and Data Engineering.

Задачи:

• Drive the Zero-Day Alert process from vulnerability triage to actionable policyholder notification
• Coordinate urgent outreach with the Security Support Center, Underwriting, and Incident Response for high-severity or actively exploited vulnerabilities
• Write and refine technology fingerprints, detection rules, and security findings that turn scan data into reliable risk signals
• Maintain and expand the distributed honeypot network, analyzing telemetry for exploitation and new adversary techniques
• Improve detection accuracy and reduce false positives using claims insights, external datasets, and vulnerability research
• Publish advisories, research, and briefings that inform security decisions
• Participate in the on-call rotation for emergency notifications

Требования:

• 5+ years in threat intelligence, vulnerability research, pen testing, or defensive security engineering
• Deep knowledge of network protocols, operating systems, web apps, and exploitation (RCE, auth bypass, edge-device vulnerabilities)
• Experience assessing new vulnerabilities under time pressure and translating them into practical enterprise risk
• Hands-on experience writing scanner detections, signatures, or parsing scripts (Python, regex, protocol fingerprints)
• Experience with honeypots, deception tech, or internet-wide scanning and other large security datasets
• Strong Python and SQL skills
• Excellent communication with both technical and non-technical audiences
• A track record of clear documentation or public security writing, plus the judgment to lead complex work independently
• Experience with Censys, Shodan, BinaryEdge, or attack surface mapping
• Reverse engineering, patch diffing, or PoC exploit verification
• Familiarity with VPNs, firewalls, load balancers, or SCADA/ICS
• Public research, CVE credits, or conference talks
• Knowledge of cyber insurance, underwriting, or risk aggregation modeling

Условия:

• 100% medical, dental and vision coverage
• Flexible PTO policy
• Annual home office stipend and WeWork access
• Mental & physical health wellness programs (One Medical, Headspace, Wellhub, and more)! Competitive compensation and opportunity for advancement Work at Coalition is centered on the joint mission to Protect the Unprotected.

We have built a remote-first, highly inclusive culture that welcomes people from diverse backgrounds. We trust each other to take responsibility, share ownership of outcomes, and put in the work together to protect businesses from digital risk. Coalition’s exceptional growth stems from its ability to address real-world problems for organizations of all sizes while remaining true to our founding values of character, humility, responsibility, purpose, authenticity, and inclusion. We’re always looking for collaborative, inquisitive individuals to join #OurCoalition. Visit our Newsroom >