LLM Engineer — Threat Intelligence Automation

Julien Moreau

Full-time · Mid-level · New_York

This role is no longer accepting applications

Similar open roles you can apply to now:

About the role

We are a cybersecurity company. We build threat intelligence and security operations platforms for enterprise customers — financial institutions, critical infrastructure operators, and large enterprises in regulated industries. Our customers' security teams receive thousands of threat signals a day. Most of them are noise. The ones that aren't are often buried under the ones that are, and the analyst who should have acted on the real one was busy processing the other nine hundred and ninety nine. The problem we are solving with LLMs is not novel — security vendors have been trying to apply AI to threat triage for years. Most of them have built systems that produce confident-sounding outputs with poor precision and no way for an analyst to understand why the system flagged something. We are building differently. Our goal is an LLM-powered threat analysis layer that surfaces the highest-priority signals, explains its reasoning in terms an analyst can verify, and is calibrated to be honest about what it doesn't know. This role is for an engineer who can build that — and who is uncomfortable with systems that sound good but aren't trustworthy.

Responsibilities

Build the LLM-powered threat triage and analysis layer that processes incoming threat signals and surfaces priority items with reasoning
Design and implement the RAG architecture that grounds threat analysis in our threat intelligence knowledge base
Develop evaluation pipelines for threat analysis output quality — precision, recall, and analyst trust calibration — that run continuously in production
Collaborate with our security research team to incorporate current threat actor knowledge into the model's analysis context
Contribute to the explainability infrastructure — building the features that let analysts understand and verify what the system flagged and why

Requirements

4+ years of ML or AI engineering with specific experience building LLM-powered systems in production
Python for LLM integration, RAG pipeline development, and building the evaluation infrastructure that monitors output quality in production
Hugging Face for working with open-source security-focused language models and fine-tuning on threat intelligence corpora
RAG pipeline design: retrieval, reranking, and grounding — building systems where the model's reasoning can be traced back to source material the analyst can inspect
LangChain or LlamaIndex for orchestrating multi-step threat analysis pipelines
SQL for working with our threat event database, analyst feedback logs, and system performance metrics
Familiarity with cybersecurity concepts — threat intelligence formats (STIX, MITRE ATT&CK), security operations workflows, or SOC tooling — is a genuine advantage and will accelerate your impact

Benefits

$132,000 – $162,000 base salary
Full remote — US, Canada, or compatible European time zones
Annual security conference budget of $2,500 (Black Hat, DEF CON, or equivalent)
Equity participation in a growth-stage security company
Work on a problem where getting the precision wrong has real operational consequences for our customers — the stakes matter