Lead Vulnerability Intelligence Analyst

Accountabilities:

• Lead the technical direction of the vulnerability intelligence practice, establishing rigorous standards for vulnerability validation, assessment, and communication.

• Research newly disclosed vulnerabilities and determine whether reported exploitation claims are technically valid and relevant to real-world environments.

• Acquire, modify, test, and validate proof-of-concept exploits in controlled virtual environments to confirm or refute exploitability claims.

• Design, build, and operate honeypots and sensor systems capable of monitoring real-world exploitation activity.

• Develop practical mitigation strategies for situations where patching is delayed, unavailable, or insufficient, including configuration hardening, network segmentation, access controls, feature disabling, and other defensive measures.

• Develop techniques for identifying both attempted and successful exploitation, including the artifacts and indicators defenders should monitor and hunt for.

• Produce detailed vulnerability intelligence reports explaining how exploits work, who is using them, who is being targeted, and what actions defenders should take.

• Build and maintain automation that streamlines vulnerability assessment, PoC testing, triage, intelligence collection, and analysis workflows.

• Identify and evaluate new sources of vulnerability intelligence and integrate valuable sources into the intelligence lifecycle from ingestion through enrichment and delivery.

• Train, mentor, and support junior team members, raising the technical capabilities and analytical standards of the wider team.

• Contribute to continuous improvements in vulnerability research methodologies, tooling, detection approaches, and intelligence coverage.

Requirements:

• Demonstrated subject-matter-expert-level knowledge of vulnerability research and intelligence, with substantial experience analyzing and validating vulnerabilities in production or research environments.

• Proven ability to validate and test proof-of-concept exploits and independently assess whether exploitation claims are technically credible.

• Strong programming ability in at least one language such as Python, Go, C, C++, or a similar language, sufficient to understand exploit code, modify PoCs, and develop custom tooling.

• Hands-on experience working with virtual machines, containers, and reusable laboratory environments for safe exploitation testing and technical analysis.

• Strong computer science fundamentals and a thorough understanding of core computing and internet technologies, including TCP/IP, HTTP, DNS, TLS, authentication, authorization, and real-world system deployment.

• Ability to develop mitigations beyond simply recommending patches and understand how defensive controls affect exploitation risk.

• Experience developing methods to detect attempted and successful exploitation and translating technical findings into actionable defensive guidance.

• Strong technical writing skills, with the ability to produce clear and detailed vulnerability intelligence reports for security professionals.

• A strong bias toward automation and demonstrated ability to build systems that make vulnerability assessment, triage, and analysis more efficient.

• Experience mentoring or training less experienced security professionals and raising technical standards across a team.

• Ability to identify new vulnerability intelligence sources and evaluate their reliability, relevance, and potential value.

• Experience building honeypots or sensor systems to monitor real-world exploitation activity is highly desirable.

• Experience automating proof-of-concept testing and validation is a strong advantage.

• Experience integrating intelligence sources end-to-end, including evaluation, ingestion, normalization, enrichment, and delivery.

• Additional valuable experience includes original vulnerability research or CVE credits, reverse engineering, detection engineering with Sigma, Snort/Suricata, or YARA, SOC operations, and familiarity with CVSS, CWE, EPSS, and the KEV catalog.

• Public speaking, conference participation, or published technical security writing is also advantageous.

Benefits:

• Competitive compensation: Market-competitive compensation based on experience and expertise.

• Remote-friendly culture: Work remotely while collaborating with an experienced international cybersecurity team.

• Wellness programs: Access programs designed to support employee health and wellbeing.

• Professional development: A variety of opportunities to expand your technical knowledge, cybersecurity expertise, and career development.

• Technical impact: Work directly on high-priority vulnerability intelligence challenges and help organizations better understand and defend against emerging threats.

• Experienced environment: Collaborate with professionals with backgrounds spanning intelligence services, military, law enforcement, cybersecurity, and private-sector threat intelligence.

• Collaborative culture: Join a supportive, fast-paced environment built around openness, inclusion, integrity, customer focus, and continuous learning.

• Mission-driven work: Contribute to protecting organizations from evolving cyber threats through timely, technically rigorous intelligence.

• International scope: Work on vulnerability and exploitation trends affecting organizations and threat actors across global markets.