Staff Research Engineer - Exposure Intelligence
About this role
Organizations struggle to filter global threat noise into structured, actionable insights that allow security teams to prioritize real cyber risks. To solve this problem, Tenable needs a Staff Research Engineer to run the daily intelligence production cycle for the Exposure Intelligence function within the Research Special Operations team.
In this hybrid position based in Boston, Massachusetts or Columbia, Maryland, the engineer will source, triage, analyze, and publish intelligence updates regarding newly disclosed zero-days and emerging threats. The ideal candidate blends deep vulnerability knowledge with rigorous operational discipline, possessing the ability to switch between fast-paced triage and comprehensive analytical writing without friction.
What you will do
- Run the morning intelligence production cycle by sourcing, triaging, classifying, and publishing finished threat intelligence.
- Assess newly disclosed zero-day vulnerabilities to determine whether they require comprehensive analytical workups.
- Write the daily operations brief that informs team priorities and compile an external digest consumed by hundreds of stakeholders.
- Produce deeper analytical products, such as threat assessments with confidence ratings and documented methodology, as well as actor profiles.
- Contribute to the Tenable blog, coordinate with public relations and product marketing on media responses, and present at conferences or webinars.
- Collaborate on evolving team capabilities, including the integration of AI-assisted workflows to extend analytical capacity.
- Respond to internal intelligence requests from product teams and leadership while gathering stakeholder feedback to refine analytical focus.
What you need
- Bring seven or more years of experience in cybersecurity, with meaningful depth in vulnerability research, threat intelligence analysis, security operations, or risk management.
- Demonstrate hands-on experience producing structured analytical intelligence, including multi-source assessments with confidence ratings and documented methodology.
- Possess deep familiarity with the vulnerability lifecycle, covering CVSS scoring, exploit maturity, CISA KEV, and active exploitation.
- Show a strong understanding of threat actors and campaigns, including attribution frameworks and MITRE ATT&CK TTP mapping.
- Exhibit excellent analytical writing and verbal communication skills through the creation of daily threat briefs, assessments, and digests.
- Maintain comfort with structured, repeatable processes and quality gates within a governed production cycle.
- Apply sound judgment under uncertainty to make rapid analytical decisions with incomplete information and honest confidence calibration.
Nice to have
- Intelligence community or military intelligence background including structured analytic techniques and source reliability assessment.
- Experience in vulnerability management programs at scale and familiarity with exposure management concepts across cloud, identity, and OT/IoT.
- Experience with AI-assisted analytical workflows and scripting skills in Python or Bash for data processing and tooling.
- Demonstrated experience writing for external audiences through blog posts, conference talks, and technical papers.
- Familiarity with exposure surface analysis tools, OSINT techniques, and production tracking systems like Jira and Confluence.
Skills and tech stack
Questions candidates ask
What is the work arrangement for this role?
This is a hybrid position with locations listed in Boston, Massachusetts and Columbia, Maryland.
What is the compensation range for this position?
The base pay range for this position is $137,500 to $183,500 USD, with compensation depending on factors such as qualifications, skills, location, and experience. Employees are also eligible for variable compensation in addition to base pay.
What does the daily routine involve?
The role requires running the morning production cycle by sourcing, triaging, classifying, analyzing, and publishing finished intelligence. The afternoon typically shifts toward deeper analytical work, framework development, or external content creation.
Are work visas sponsored for this job?
Applicants must be authorized to work for any employer in the U.S. without sponsorship. Tenable is unable to provide sponsorship for work visas of any kind at the time of hire or during employment.