[Hiring] Threat Hunter @VulnCheck

Role Description

VulnCheck is hiring a Principal Threat Hunter to discover, investigate, and document real-world exploitation and attacker infrastructure, and turn those discoveries into durable improvements to VulnCheck's detection capabilities.

• Hunt for emerging exploitation activity, attacker infrastructure, and novel attacker behavior across VulnCheck's data.
• Turn discoveries from threat hunting into durable improvements to VulnCheck's detection capabilities, including new rules, queries, tooling, and automation.
• Investigate exploitation attempts, attacker payloads, binaries, infrastructure, and post-exploitation activity.
• Build tooling and automation to support threat hunting and large-scale analysis.
• Pivot across vulnerabilities, hosts, IPs, domains, payloads, and other infrastructure to uncover relationships and broader activity.
• Turn research findings into actionable threat intelligence for VulnCheck customers.
• Write customer-facing threat intelligence reports and technical blog posts that clearly explain what you found and why it matters.
• Present research at conferences and other industry events.
• Work with vulnerability researchers and other members of the VulnCheck research team to connect observed exploitation with vulnerability intelligence.
• Help shape the direction, methodology, and capabilities of VulnCheck's threat hunting function as it grows.
• Use VulnCheck's data and products as an expert customer, identify gaps in our ability to detect or investigate attacker activity, and help drive improvements to close those gaps.

Qualifications

• A demonstrated track record of communicating technical security research through public writing, threat intelligence reports, blogs, presentations, or other published work.
• Experience hunting for threats, analyzing attacker activity, conducting threat intelligence research, or performing closely related security research.
• The ability to read and analyze PCAPs and reason about network traffic and protocols.
• Demonstrated experience developing and tuning detections, including Suricata and/or Snort rules, and translating research findings into repeatable detection capabilities.
• Experience writing Nuclei templates or other scanners to identify vulnerabilities, exposed services, or attacker infrastructure.
• Strong programming or scripting ability, with comfort reading and writing code in multiple languages and picking up unfamiliar languages when the research requires it.
• Experience working with Linux systems, networking, and internet-facing infrastructure.
• The ability to analyze malware, payloads, scripts, and other artifacts encountered during an investigation.
• Experience working with large datasets and developing queries or tooling to find meaningful activity within them.
• The ability to pivot across technical data sources and follow an investigation from an initial indicator to a broader set of infrastructure or activity.
• The curiosity and independence to identify interesting research questions and pursue them without a predefined playbook.

Preferred Qualifications

• A substantial body of published security research, particularly work that has had an impact on the security community.
• Experience researching exploitation campaigns, malware families, attacker infrastructure, or vulnerability exploitation in the wild.
• Experience working across multiple areas of security research, such as vulnerability research, reverse engineering, malware analysis, threat intelligence, or detection engineering.
• Experience leading threat intelligence or security research initiatives, including establishing research direction, methodologies, or operational processes.

Benefits

• Unlimited PTO
• 401k plan
• Comprehensive healthcare coverage
• Generous paid parental leave
• Remote friendly environment with flexibility
• Expense reimbursement for Cell Phone & Internet
• Ongoing professional development, coaching, and learning resources
• Opportunities for career advancement within a fast-growing team