Note: The job is a remote job and is open to candidates in USA. Censys is a company focused on providing comprehensive Internet intelligence and actionable threat insights. The Research Systems Analyst will build and operate scalable pipelines and platforms for file analysis, threat indicator enrichment, and graph-based threat intelligence, while partnering with threat researchers and detection engineers to deliver production-grade systems.
Responsibilities
- Design, build, and maintain static and dynamic file analysis pipelines capable of processing artifacts at scale
- Maintain, and optimize YARA rule sets, including tooling for rule testing, performance, and false-positive management
- Operate and extend threat indicator enrichment systems for real-time file metadata extraction, scanning, and enrichment
- Build and grow threat graph intelligence systems, modeling relationships between indicators, malware, infrastructure, and actors
- Design and maintain dynamic analysis (sandboxing/detonation) capability, including behavioral telemetry collection and safe execution environments
- Build ingestion and normalization pipelines connecting internal Censys scan data with external threat intel feeds
- Instrument pipelines for reliability and observability (logging, monitoring, alerting, SLAs)
- Partner with threat research and detection engineering teams to translate analytical needs into scalable systems
- Maintain secure handling and isolation practices for malicious samples and analysis environments
- Document architecture, runbooks, and operational procedures for the systems you own
Skills
- Bachelor's degree in Computer Science, Engineering, or equivalent practical experience
- 6+ years building security data pipelines, detection engineering systems, or threat intelligence platforms
- Experience with Synapse or other graph-based threat intel platforms (e.g., Maltego, Neo4j), including graph data modeling
- Strong programming skills in Python and/or Go
- Working knowledge of static and dynamic malware analysis (disassemblers, sandboxes such as Cuckoo/CAPE, debuggers) tooling and pipelines
- Experience with distributed data pipelines and message queues (Kafka, RabbitMQ) and data stores (Elasticsearch, S3, etc.)
- Familiarity with containerization/orchestration (Docker, Kubernetes) for isolated execution environments
- Demonstrated experience with cloud infrastructure (AWS, GCP, or Azure) designing and operating highly-available systems for critical, production-grade applications
- Demonstrated use of LLM-based coding harnesses and agent-based development workflows (e.g., Claude Code, Copilot, or similar) to accelerate delivery timelines
- This position is located fully remote with no expectations to come into an office regularly
- Experience with Synapse, MISP, OpenCTI, or other TIP platforms
- Familiarity with STIX/TAXII
- Experience working with internet-wide scan data
- Open source contributions to security tooling (YARA rules, Strelka scanners, Synapse modules)
- CI/CD experience applied to detection content
- Familiarity with SOC 2, ISO 27001, or similar security/compliance frameworks as they relate to handling sensitive data
- Hands-on experience authoring and managing YARA rules at scale
- Experience with Strelka or comparable file scanning frameworks (e.g., Assemblyline, FAME)
Benefits
- Fully remote with no expectations to come into an office regularly.
- Equity
- Health, dental & vision coverage
- Retirement with company contribution
- Parental leave
- Mental health & wellness benefits
- Flexible PTO
- A professional development stipend
- Annual bonus plan for eligible non-sales roles
- For employees located outside of the US, location-specific benefits are available and the information pertaining to those will be provided to you during the interview process.
Company Overview
Company H1B Sponsorship