Staff Research Engineer

Who you are

• The right candidate can context-switch between operational triage and deep analysis, writes clearly and concisely to deliver time-sensitive deliverables, and treats repeatable process as a feature rather than a constraint
• 7+ years in cybersecurity: with meaningful depth in at least two of: vulnerability research, threat intelligence analysis, security operations, or exposure/risk management
• Experience producing structured analytical intelligence: Beyond just advisories or blog posts, including multi-source assessments with confidence ratings and documented methodology. Experience with intelligence community analytic standards is preferred
• Deep familiarity with the vulnerability lifecycle: Understanding the state of a vulnerability from disclosure through exploitation. You understand CVSS scoring, exploit maturity, CISA KEV, and the difference between a vulnerability existing and an exposure being actively exploited in the wild
• Strong understanding of threat actors and campaigns: attribution frameworks, TTP mapping (MITRE ATT&CK), and the ability to classify threats at the right level without inflation
• Excellent analytical writing and verbal communication skills: This role produces significant written output daily including threat briefs, assessments, digests and blog posts
• Comfort with structured, repeatable processes: This role involves executing within a structured and governed production cycle with quality gates and standards, not just ad hoc research
• Sound judgment under uncertainty: Rapid analytical decisions with incomplete information, with honest confidence calibration. This role requires the ability to work independently and make informed decisions with accuracy and precision
• Ability to manage multiple concurrent workstreams and shifting priorities
• Intelligence community or military intelligence background including structured analytic techniques, source reliability assessment, analytic confidence frameworks
• Experience in vulnerability management programs at scale, and understanding of what SOC teams actually need from threat intelligence to prioritize
• Familiarity with exposure management concepts with an understanding of the shift from vulnerability-centric to exposure-centric risk management, including cloud, identity, and OT/IoT
• Experience with AI-assisted analytical workflows. The team uses AI extensively as an analytical co-pilot
• Scripting and automation skills (Python, Bash, or similar) for data processing and tooling. This is not a software engineering role, but the ability to work with APIs and automate tasks is valuable
• Demonstrated experience writing for external audiences including blog posts, conference talks, media interviews and technical papers
• Experience with Tenable products (Tenable One, Nessus, Security Center) or competitive vulnerability management platforms
• Familiarity with exposure surface analysis tools (Shodan, Censys, GreyNoise) and OSINT techniques
• Experience with production tracking systems (Jira, Confluence) in a daily-cadence operational context
• Background in non-CVE exposure domains (e.g., cloud security, identity and credential exposure, shadow AI, OT/IoT)

What the job involves

• Tenable's Research Special Operations (RSO) team produces the exposure intelligence and analysis that helps organizations understand and prioritize cyber risk. We translate what's happening in the global threat landscape into structured, actionable intelligence for SOC analysts, vulnerability management engineers, field teams, and CISO-level stakeholders
• We're looking for a Staff Research Engineer who will be primarily responsible for executing the daily intelligence production cycle for our Exposure Intelligence function. You'll run the morning production cycle; sourcing, triaging, classifying, analyzing, and publishing finished intelligence in collaboration with other team members
• On a typical day you might assess a newly disclosed zero-day, determine whether it warrants a full analytical workup, write the daily brief that informs operational priorities, and publish an external digest consumed by hundreds of stakeholders, then shift to deeper analytical work, framework development, or external content in the afternoon
• This isn't a traditional security research role. The work blends intelligence analysis, production discipline, and analytical writing on a daily cadence
• You have primary responsibility for executing the operational aspects of the Security Response process. That means monitoring a broad source ecosystem, triaging what matters, and producing the daily operations brief that informs the team's priorities, and an external intelligence digest distributed to a broad cross-section of stakeholders
• You will make fast, well-calibrated decisions, often with incomplete or imperfect information, and communicate those decisions clearly to the rest of the Research team and to leadership, sometimes at short notice. You will apply structured analytical judgment to response decisions, assessing exploit maturity, likely attacker interest, and blast radius with clear confidence calibration
• Beyond the daily cycle, you'll produce deeper analytical products including threat assessments with confidence ratings and documented methodology, actor and campaign profiles, and focused analytical notes on individual CVEs or exposure conditions. You'll also write blog posts for the Tenable blog, coordinate with public relations and product marketing on media responses, and contribute to webinars and conference presentations
• As a senior contributor, you will provide input into the classification standards, analytical methodologies, and source management practices that underpin the team's work. You will identify opportunities for improvement based on your experience executing the daily production cycle and collaborate with other team members on evolving these capabilities, including AI-assisted workflows that extend the team's analytical capacity
• Contribute to development and execution of the team's strategic priorities, respond to internal intelligence requests from product teams and leadership, collaborate with stakeholders to understand their intelligence needs, and bring those perspectives back to the team to help inform analytical priorities and areas of focus beyond daily response work

Benefits

• Health: Comprehensive benefits to support physical and mental wellbeing and family-forming plans
• Work/Life Balance: Generous paid time off with hybrid or remote opportunities available for most positions
• Financial Savings and Security: Retirement plans, employee stock purchase plan (ESPP), equity incentives, life and disability insurance
• Professional Development: Customizable opportunities, including learning courses, mentorship, leadership programs and tuition reimbursement