Security Research Engineer, Attack Surface & Risk Signals

Are you fascinated by the underlying architecture of the internet? As a Quantitative Cyber Risk Engineer, you will play a critical role at the intersection of network engineering, cybersecurity, and data science. You will analyze how global businesses configure their internet-facing assets and design mathematical signals that accurately quantify their exposure to cyber attacks. Working alongside Data Scientists, Engineers, and Product teams, your research and models will directly drive the next generation of risk-scoring and analytical engines for the cyber insurance industry.

Responsibilities

Design innovative, quantitative risk signals that measure a company's exposure to cyber attacks based on network architecture, asset configurations, and internet footprint; Translate theoretical cybersecurity concepts and complex network topologies into empirical, actionable risk metrics and assumptions; Evaluate and extract insights from how organizations deploy and configure internet-facing protocols, cloud infrastructure, and enterprise networks; Conduct in-depth research on emerging cyber threats and map them to underlying asset configurations; Serve as subject matter expert on internet architecture, collaborating with product, analytics, and engineering teams to integrate risk signals into production models

Requirements

Expert-level understanding of how the internet works at a foundational level, including network protocols (TCP/IP, BGP, DNS, HTTP/S, TLS), routing, ASN ecosystems, and complex enterprise network configurations; Proven ability to apply mathematical and statistical concepts to real-world problems and design quantitative metrics that score and size risk exposure; Exceptional problem-solving skills and a track record of breaking down complex, abstract security concepts into measurable data points; Bachelor's or Master's degree in Computer Science, Computer Engineering, Mathematics, Statistics, or a related highly quantitative/technical field; 3–5+ years of relevant work experience in network engineering, cyber threat research, risk modeling, or a related domain

Nice to have

Proficiency in Python or R to prototype algorithms and turn theoretical risk concepts into programmatic outputs; Experience with SQL and relational databases to pull, manipulate, and analyze large datasets of asset and configuration data; Familiarity with big data frameworks (Spark / Hadoop), flat files, complex data types (JSON, XML), and working with APIs; Experience working in or adjacent to the cyber insurance, risk modeling, or data science industries; Advanced technical or security certifications (e.g., CISSP, CISM, advanced Cisco/networking certifications)