Senior Phishing Tradecraft Researcher

Huntress is a remote-first team founded in 2015 by former NSA cyber operators, working to make enterprise-grade cybersecurity accessible to businesses of all sizes. The Senior Product Researcher for the Security Awareness Training product will build and implement simple solutions that are disproportionately effective at countering evolving threats. The role reports to the Manager, Product Research. One should have experience managing, deploying, and securing SMB environments utilizing a wide variety of security software, best practices, and automation tools. Compensation range: $170,000.00 to $185,000.00 base plus bonus and equity.

Responsibilities

Operate a proven industry-leading Security Awareness Training phishing program; Be the security expert designing and building phishing scenario emails & landing pages that simulate real cyber attacks for thousands of SAT learners; Pair every simulation with coaching that shows learners social engineering tells and how to identify social engineering tradecraft; Craft and expand a library of common indicators and write new ones when a scenario calls for it; Script and code proofs-of-concept and tooling, creating pixel-perfect simulated phishing emails & landing pages using HTML, CSS, JavaScript, & React; Identify emerging social engineering tradecraft from attack patterns, email metadata, and web expertise, and translate attacker tactic shifts into training content; Automate phishing content generation as an AI-powered system using Claude Code; Expand the program into new regions, more languages, more tailored content, and new kinds of learning experiences with guidance from the Product Manager and Principal Product Researcher; Triage reported phishing emails and internal and external security incidents, surfacing threat insights and trend analysis for the Huntress Threat Report, threat advisories, social media, webinars & conference talks, and strategic security awareness outreach campaigns; Align with the Principal Researcher to deliver unified Security Awareness Training and phishing program outcomes; Apply organizational and project management skills with attention to detail and urgency to deliver an exceptional product under tight deadlines; Engage, report, and be accountable to executive stakeholders; Translate expertise in technical and nontechnical ways to deliver impactful security outcomes that protect the 99%

Requirements

Proficiency with HTML, CSS, Javascript & React, Angular, or Vue; Proficiency with Claude Code, Codex, or Cursor with impressive projects to prove it; Experience in manually building phishing simulation deliverables like emails and landing pages, simulating phishing attacks, then analyzing & reporting simulation results; Experience triaging reported phishing emails, security incidents, and identifying trends + patterns; Experience in analyzing, tracking, and defending against phishing attacks; Experience identifying emerging tradecraft; Social engineering experience, coursework, training, certifications; Experience innovating training content; Experience with eLearning design and development; Experience developing marketing content for social media, YouTube, blogs & reports

Nice to have

Familiarity with product management, incident response, social engineering, psychology, education, and managed service provider tools; Spanish language skills desired, but not required

Benefits

100% remote work environment; Generous paid time off policy, including vacation, sick time, and paid holidays; 12 weeks of paid parental leave; Highly competitive and comprehensive medical, dental, and vision benefits plans; 401(k) with a 5% contribution regardless of employee contribution; Life and Disability insurance plans; Stock options for all full-time employees; One-time $500 reimbursement for building/upgrading home office; Annual allowance for education and professional development assistance; $75 USD/month digital reimbursement; Access to the BetterUp platform for coaching, personal, and professional growth