[Hiring] Senior Threat Intelligence Engineer @Coalition

Role Description

Join Coalition’s Threat Intelligence team to identify emerging vulnerabilities and exploitation activity before they cause loss for policyholders. You’ll lead key parts of the Zero-Day Alert process and build the detections, honeypots, and first-party threat intelligence behind Coalition’s Active Insurance platform, working across Security, Underwriting, Incident Response, Product, and Data Engineering.

Responsibilities

• Drive the Zero-Day Alert process from vulnerability triage to actionable policyholder notification
• Coordinate urgent outreach with the Security Support Center, Underwriting, and Incident Response for high-severity or actively exploited vulnerabilities
• Write and refine technology fingerprints, detection rules, and security findings that turn scan data into reliable risk signals
• Maintain and expand the distributed honeypot network, analyzing telemetry for exploitation and new adversary techniques
• Improve detection accuracy and reduce false positives using claims insights, external datasets, and vulnerability research
• Publish advisories, research, and briefings that inform security decisions
• Participate in the on-call rotation for emergency notifications

Qualifications

• 5+ years in threat intelligence, vulnerability research, pen testing, or defensive security engineering
• Deep knowledge of network protocols, operating systems, web apps, and exploitation (RCE, auth bypass, edge-device vulnerabilities)
• Experience assessing new vulnerabilities under time pressure and translating them into practical enterprise risk
• Hands-on experience writing scanner detections, signatures, or parsing scripts (Python, regex, protocol fingerprints)
• Experience with honeypots, deception tech, or internet-wide scanning and other large security datasets
• Strong Python and SQL skills
• Excellent communication with both technical and non-technical audiences
• A track record of clear documentation or public security writing, plus the judgment to lead complex work independently

Bonus Points

• Experience with Censys, Shodan, BinaryEdge, or attack surface mapping
• Reverse engineering, patch diffing, or PoC exploit verification
• Familiarity with VPNs, firewalls, load balancers, or SCADA/ICS
• Public research, CVE credits, or conference talks
• Knowledge of cyber insurance, underwriting, or risk aggregation modeling

Benefits

• 100% medical, dental and vision coverage
• Flexible PTO policy
• Annual home office stipend and WeWork access
• Mental & physical health wellness programs (One Medical, Headspace, Wellhub, and more)!
• Competitive compensation and opportunity for advancement