Senior Threat Intelligence Engineer

About the role

Join Coalition’s Threat Intelligence team to identify emerging vulnerabilities and exploitation activity before they cause loss for policyholders. You’ll lead key parts of the Zero-Day Alert process and build the detections, honeypots, and first-party threat intelligence behind Coalition’s Active Insurance platform, working across Security, Underwriting, Incident Response, Product, and Data Engineering.

Responsibilities

Drive the Zero-Day Alert process from vulnerability triage to actionable policyholder notification

Coordinate urgent outreach with the Security Support Center, Underwriting, and Incident Response for high-severity or actively exploited vulnerabilities

Write and refine technology fingerprints, detection rules, and security findings that turn scan data into reliable risk signals

Maintain and expand the distributed honeypot network, analyzing telemetry for exploitation and new adversary techniques

Improve detection accuracy and reduce false positives using claims insights, external datasets, and vulnerability research

Publish advisories, research, and briefings that inform security decisions

Participate in the on-call rotation for emergency notifications

Skills and Qualifications

5+ years in threat intelligence, vulnerability research, pen testing, or defensive security engineering

Deep knowledge of network protocols, operating systems, web apps, and exploitation (RCE, auth bypass, edge-device vulnerabilities)

Experience assessing new vulnerabilities under time pressure and translating them into practical enterprise risk

Hands-on experience writing scanner detections, signatures, or parsing scripts (Python, regex, protocol fingerprints)

Experience with honeypots, deception tech, or internet-wide scanning and other large security datasets

Strong Python and SQL skills

Excellent communication with both technical and non-technical audiences

A track record of clear documentation or public security writing, plus the judgment to lead complex work independently

Bonus Points

Experience with Censys, Shodan, BinaryEdge, or attack surface mapping

Reverse engineering, patch diffing, or PoC exploit verification

Familiarity with VPNs, firewalls, load balancers, or SCADA/ICS

Public research, CVE credits, or conference talks

Knowledge of cyber insurance, underwriting, or risk aggregation modeling

Compensation

As a remote-first organization, our compensation reflects the cost of labor across several Canadian geographic markets.

In Alberta, British Columbia & Ontario the base salary for this position ranges from $149,600/year up to $190,000 /year.

For all other locations, the base salary for this position ranges from $106,700/year up to $133,425.00/year.

Consistent with applicable laws, an employee's pay within this range is based on a number of factors, which include but are not limited to relevant education, skills, job-related knowledge, qualifications, work experience, credentials, and/or geographic location. Your Recruiter can share more on the specific target salary range for your location during the interview process. Coalition, Inc. reserves the right to modify this range as needed.

Vacancy Status: This posting is for an existing vacancy.

Use of AI: We utilize AI-assisted tools to help us organize and review the high volume of applications we receive. However, our human recruiting team makes all final hiring decisions and interview selections, valuing personal connection over algorithms.

Application Updates: Consistent with our commitment to transparency, if you are interviewed for this role, we will provide a status update on your application within 45 days of your final interview.

Perks

100% medical, dental, and vision coverage

Flexible PTO

Annual home office stipend and WeWork access

Mental & physical health wellness programs like Headspace, Lumino, and more!

Competitive compensation and opportunity for advancement