Lead Threat Researcher

About Us

Nebulock is an agentic threat hunting platform that autonomously surfaces behaviors, not just IOCs, from various data sources. Nebulock acts like a teammate: a 24/7 AI threat hunter that investigates hypotheses, reasons through telemetry, and learns from an environment. Today, threat hunting is broken. Security teams spend weeks chasing alerts, writing detections by hand, and manually validating findings often just to confirm what their existing tools already flagged. Meanwhile, attackers exploit credentials, move laterally, and operate in silence. Nebulock flips the model. We continuously and autonomously hunt across endpoint, identity, and cloud telemetry identifying the subtle behavioral signals that point to credential misuse, lateral movement, insider threats, and post-access activity. Then we turn those hunts into hardened, behavior-based detections automatically.

Position Overview

We're hiring a Lead Threat Researcher to build the system that determines what actually matters for each specific customer. Your research, opinions, and the tooling you build will help determine what both our threat hunting agents and our internal threat hunters and detection engineers choose to prioritize. You will be the authoritative voice on what actually deserves attention versus what is noise. This role is ideal for someone who wants to build and redesign the threat research function in the age of agentic AI. While you are not expected to ship customer-facing production quality code, you must be excited to experiment and prototype in order to unblock yourself and inform what Software Engineering should build.

Qualifications

• 7+ years in threat intelligence or threat research with exposure across multiple industries
• Deep expertise in mapping threat actor TTPs to observable telemetry
• Strong understanding of adversary tradecraft across endpoint, cloud, and IAM
• Experience and excitement about using AI-assisted development tools to build lightweight tooling, automations, and prototypes
• Demonstrated ability to prototype, iterate, and ultimately build your own tooling
• Demonstrated ability to distill complex topics into something actionable and understandable
• Active participation in threat intelligence sharing communities