{"id":1536073,"url":"https://alion.io/job/vulncheck-threat-hunter","title":"Principal Threat Hunter","company":{"id":42912,"name":"VulnCheck","domain":"vulncheck.com","url":"https://alion.io/company/vulncheck","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":120000,"max_usd":235000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":83},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ETL/ELT","optional":false},{"name":"Linux","optional":false},{"name":"LLM","optional":false},{"name":"Nuclei","optional":false},{"name":"Snort","optional":false},{"name":"Suricata","optional":false}],"status":"live","first_seen_at":"2026-09-30T15:34:05Z","employer_posted_date":"2026-09-30","last_verified_at":"2026-10-17T12:21:40Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":16},"description":"Principal Threat Hunter (Remote, US)\nLocation: Remote, United States\nTeam: Product & Engineering\nEmployment Type: Full-Time, Remote\nAbout VulnCheck\nExploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The Exploit Intelligence Company, delivers structured exploit intelligence on what is actively weaponized in the wild, purpose-built for the data lakes, ETL pipelines, automation, and AI and LLM workflows your infrastructure already runs on, raising the capability of everything it powers.\nAbout the Role\nVulnCheck is hiring a Principal Threat Hunter to discover, investigate, and document real-world exploitation and attacker infrastructure, and turn those discoveries into durable improvements to VulnCheck's detection capabilities.\nVulnCheck operates infrastructure across the internet that gives us a direct view into attacker activity. Canary Intelligence deploys intentionally vulnerable systems and captures real exploitation attempts, giving researchers a steady stream of attacker binaries, source infrastructure, payloads, and exploitation techniques. Target Intelligence maintains a continuously updated view of internet-facing systems, including their exposure to known vulnerabilities and their relationships to scanners, proxies, C2 infrastructure, and other attack infrastructure.\nTogether, these datasets provide a foundation for research that is difficult to replicate elsewhere. You can observe exploitation as it happens rather than infer it from secondary telemetry, analyze what attackers deploy after gaining access, and pivot from an attacking host into the broader infrastructure behind it.\nThe role spans the full research process. You will hunt for interesting activity, investigate what you find, develop methods and detections to identify similar activity at scale, and turn those investigations into original threat intelligence. You will help build the tooling and detections needed to support your research and improve VulnCheck's ability to identify meaningful attacker activity.\nYou will be the first full-time threat hunter at VulnCheck, so there is no existing threat hunting pipeline or playbook to inherit. You will have substantial latitude to define areas of research and help establish how VulnCheck approaches threat hunting as the function grows.\nThis role is fully remote and open to candidates based anywhere in the United States.\nWhat You'll Do\nHunt for emerging exploitation activity, attacker infrastructure, and novel attacker behavior across VulnCheck's data\nTurn discoveries from threat hunting into durable improvements to VulnCheck's detection capabilities, including new rules, queries, tooling, and automation\nInvestigate exploitation attempts, attacker payloads, binaries, infrastructure, and post-exploitation activity\nBuild tooling and automation to support threat hunting and large-scale analysis\nPivot across vulnerabilities, hosts, IPs, domains, payloads, and other infrastructure to uncover relationships and broader activity\nTurn research findings into actionable threat intelligence for VulnCheck customers\nWrite customer-facing threat intelligence reports and technical blog posts that clearly explain what you found and why it matters\nPresent research at conferences and other industry events\nWork with vulnerability researchers and other members of the VulnCheck research team to connect observed exploitation with vulnerability intelligence\nHelp shape the direction, methodology, and capabilities of VulnCheck's threat hunting function as it grows\nUse VulnCheck's data and products as an expert customer, identify gaps in our ability to detect or investigate attacker activity, and help drive improvements to close those gaps\nWhat You'll Bring\nA demonstrated track record of communicating technical security research through public writing, threat intelligence reports, blogs, presentations, or other published work\nExperience hunting for threats, analyzing attacker activity, conducting threat intelligence research, or performing closely related security research\nThe ability to read and analyze PCAPs and reason about network traffic and protocols\nDemonstrated experience developing and tuning detections, including Suricata and/or Snort rules, and translating research findings into repeatable detection capabilities\nExperience writing Nuclei templates or other scanners to identify vulnerabilities, exposed services, or attacker infrastructure\nStrong programming or scripting ability, with comfort reading and writing code in multiple languages and picking up unfamiliar languages when the research requires it\nExperience working with Linux systems, networking, and internet-facing infrastructure\nThe ability to analyze malware, payloads, scripts, and other artifacts encountered during an investigation\nExperience working with large datasets and developing queries or tooling to find meaningful activity within them\nThe ability to pivot across technical data sources and follow an investigation from an initial indicator to a broader set of infrastructure or activity\nThe curiosity and independence to identify interesting research questions and pursue them without a predefined playbook\nPreferred Qualifications\nA substantial body of published security research, particularly work that has had an impact on the security community\nExperience researching exploitation campaigns, malware families, attacker infrastructure, or vulnerability exploitation in the wild\nExperience working across multiple areas of security research, such as vulnerability research, reverse engineering, malware analysis, threat intelligence, or detection engineering\nExperience leading threat intelligence or security research initiatives, including establishing research direction, methodologies, or operational processes\nWhat We Offer\nWe believe people do their best work when they feel supported, trusted, and valued. VulnCheck offers benefits designed to meet a wide range of needs and lifestyles:\nBenefits and Perks\nUnlimited PTO\n401k plan\nComprehensive healthcare coverage\nGenerous paid parental leave\nRemote friendly environment with flexibility\nExpense reimbursement for Cell Phone & Internet\nOngoing professional development, coaching, and learning resources\nOpportunities for career advancement within a fast-growing team\nWhy Join Us\nBuilt on over two decades of cybersecurity experience, our team of experts understands the intricacies of vulnerabilities, their exploitation in the wild, and how to leverage this data to build more effective cybersecurity products that produce better outcomes for organizations.\nVulnCheck gives organizations a tactical advantage by providing best-in-class exploit & vulnerability intelligence information. We have a sense of duty to protect the critical infrastructure we rely on including medical devices, power grids and telecommunication networks. We were founded in 2021 in Lexington, Massachusetts.\nVulnCheck has a transparent, collaborative, and supportive culture - we are looking for people who have a growth mindset, are curious and innovative. Our team is smart, but humble, hardworking, and supportive.\nVulnCheck is proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. VulnCheck is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. Even if your experience doesn't perfectly align with the job description, we encourage you to apply - we value potential just as much as a perfect resume.","description_format":"text","description_chars":7927,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Parental leave","Professional development","Remote friendly","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-09-30T18:47:01Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.899,"p_room":1,"age_days":16,"expected_fill_days":62,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/vulncheck-threat-hunter","json_url":"https://alion.io/job/vulncheck-threat-hunter.json","meta":{"generated_at":"2026-10-17T12:39:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16825,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":42912},"rest":"https://alion.io/mcp/rest/get_company?id=42912"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fvulncheck-threat-hunter"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fvulncheck-threat-hunter"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fvulncheck-threat-hunter"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/vulncheck-threat-hunter\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fvulncheck-threat-hunter"}]}