Systems Engineer at Censys

Job description

Join the team, turning internet intelligence into real-world security outcomes. Built on the world’s most comprehensive and accurate map of the Internet , the Censys Platform delivers real-time visibility and actionable intelligence needed to accelerate triage, investigate threats, hunt adversaries, and manage Internet exposure. We're trusted by half of the Fortune 500 and government agencies all around the world, and looking for people as passionate about the problems we're solving as we are. The Systems Engineer will be a part of the Censys ARC (Advanced Research Collective) and will build and operate the pipelines and platforms that power Censys's threat detection and intelligence capabilities. This role will own the engineering behind static and dynamic file analysis at scale, and the graph-based systems that connect indicators, infrastructure, and actors into actionable threat intelligence. You'll work closely with threat researchers and analysts, turning detection and correlation requirements into production-grade systems. For a systems engineer who's spent years wiring together detection pipelines and threat intel platforms, this role is the rare chance to build that infrastructure at the actual source of the data rather than downstream of it. Censys's internet-wide scan visibility means the enrichment and graph systems you're building aren't consuming someone else's feed, they're powering primary intelligence on global infrastructure and actors. You'd own meaningful technical surface end-to-end: static/dynamic analysis pipelines, YARA tooling, sandboxing, and threat graph modeling connecting indicators to actors, rather than being one contributor on a sprawling platform team. The ARC structure — sitting between engineering and research — means your systems get shaped directly by what threat researchers actually need next, not by a backlog several layers removed from the analysts using it. And for someone who wants to work at the edge of the field rather than behind it, the expectation of using LLM-based coding harnesses to move fast signals a team that's building for how security engineering actually works now, not clinging to legacy velocity. What You'll Do Design, build, and maintain static and dynamic file analysis pipelines capable of processing artifacts at scale Maintain, and optimize YARA rule sets, including tooling for rule testing, performance, and false-positive management Operate and extend threat indicator enrichment systems for real-time file metadata extraction, scanning, and enrichment Build and grow threat graph intelligence systems, modeling relationships between indicators, malware, infrastructure, and actors Design and maintain dynamic analysis (sandboxing/detonation) capability, including behavioral telemetry collection and safe execution environments Build ingestion and normalization pipelines connecting internal Censys scan data with external threat intel feeds Instrument pipelines for reliability and observability (logging, monitoring, alerting, SLAs) Partner with threat research and detection engineering teams to translate analytical needs into scalable systems Maintain secure handling and isolation practices for malicious samples and analysis environments Document architecture, runbooks, and operational procedures for the systems you own What You'll Need: Bachelor's degree in Computer Science, Engineering, or equivalent practical experience 6+ years building security data pipelines, detection engineering systems, or threat intelligence platforms Experience with Synapse or other graph-based threat intel platforms (e.g., Maltego, Neo4j), including graph data modeling Strong programming skills in Python and/or Go Working knowledge of static and dynamic malware analysis (disassemblers, sandboxes such as Cuckoo/CAPE, debuggers) tooling and pipelines Experience with distributed data pipelines and message queues (Kafka, RabbitMQ) and data stores (Elasticsearch, S3, etc.) Familiarity with containerization/orchestration (Docker, Kubernetes) for isolated execution environments Demonstrated experience with cloud infrastructure (AWS, GCP, or Azure) designing and operating highly-available systems for critical, production-grade applications Demonstrated use of LLM-based coding harnesses and agent-based development workflows (e.g., Claude Code, Copilot, or similar) to accelerate delivery timelines What Sets You Apart: Experience with Synapse, MISP, OpenCTI, or other TIP platforms Familiarity with STIX/TAXII Experience working with internet-wide scan data Open source contributions to security tooling (YARA rules, Strelka scanners, Synapse modules) CI/CD experience applied to detection content Familiarity with SOC 2, ISO 27001, or similar security/compliance frameworks as they relate to handling sensitive data Hands-on experience authoring and managing YARA rules at scale Experience with Strelka or comparable file scanning frameworks (e.g., Assemblyline, FAME) This position is located fully remote with no expectations to come into an office regularly. For high cost of living areas in the US (San Francisco / Seattle / NYC), the expected salary range for this position is $190,000 - $240,000 USD, plus bonus eligibility and equity.For all other locations in the US, the expected salary range for this position is $170,000 USD - $220,000 USD, plus bonus eligibility and equity. For candidates being considered outside of the US, location specific market data will be evaluated and discussed during the interview process. Job level and actual compensation will be decided based on factors including, but not limited to, individual qualifications objectively assessed during the interview process (including skills and prior relevant experience, potential impact, and scope of role), market demands, and specific work location. The listed range is a guideline, and the range for this role may be modified. For roles that are available to be filled remotely, the pay range is localized according to employee work location by a factor of between 83% and 100% of range. Please discuss your specific work location with your recruiter for more information. For US Employees: Censys offers a competitive benefits package to employees, including equity, health, dental & vision coverage, retirement with company contribution, parental leave, mental health & wellness benefits, flexible PTO, and a professional development stipend. Censys also offers sales incentive pay for most sales roles and an annual bonus plan for eligible non-sales roles. Please see our careers page for more details. For employees located outside of the US, location-specific benefits are available and the information pertaining to those will be provided to you during the interview process. We will work to ensure individuals with disabilities are provided reasonable accommodation to apply for a role, participate in the interview process, perform essential job functions, and receive other benefits and privileges of employment. If you require accommodation, please reach out to your recruiter. These modifications enable an individual with a disability to have an equal opportunity not only to get a job, but successfully perform their job tasks to the same extent as people without disabilities. To ensure the integrity of our hiring process and in attempt to facilitate a more personal connection, we require all candidates to keep their cameras on during video interviews. You may also be required to meet a Censys employee at one point during your process. Additionally, if hired, you will be invited to visit Ann Arbor, Michigan for in-person onboarding. By applying for this job, the candidate acknowledges and agrees that any personal data contained in their application or supporting materials will be processed in accordance with our Censys Privacy Policy . We value diversity and are committed to creating an inclusive environment for all employees. Censys is an equal opportunity employer . Note to external recruiters/agencies: We are not currently engaging with third-party agencies for this role and will not accept unsolicited outreach . We kindly ask that you do not submit resumes or candidate profiles to our team. Identity Verification As part of our hiring process, all candidates who receive an offer of employment will be asked to complete an identity verification through CLEAR. California Privacy Rights Notice Pursuant to the California Consumer Privacy Act (CCPA), we are providing you with notice that we collect personal information from job applicants for business purposes, including evaluating your candidacy for employment, conducting interviews, and, if applicable, completing the hiring process. The categories of information we may collect include identifiers (such as name and contact information), professional or employment-related information (such as work history, education, and references), and other information you provide in your application. We do not sell or share your personal information. For more information on how we use and protect your personal information, and your rights under the CCPA, please refer to our Privacy Policy .

Requirements

Must-haves

Design, build, and maintain static and dynamic file analysis pipelines capable of processing artifacts at scale
Maintain, and optimize YARA rule sets, including tooling for rule testing, performance, and false-positive management
Operate and extend threat indicator enrichment systems for real-time file metadata extraction, scanning, and enrichment
Build and grow threat graph intelligence systems, modeling relationships between indicators, malware, infrastructure, and actors
Design and maintain dynamic analysis (sandboxing/detonation) capability, including behavioral telemetry collection and safe execution environments
Build ingestion and normalization pipelines connecting internal Censys scan data with external threat intel feeds
Instrument pipelines for reliability and observability (logging, monitoring, alerting, SLAs)
Partner with threat research and detection engineering teams to translate analytical needs into scalable systems
Maintain secure handling and isolation practices for malicious samples and analysis environments
Document architecture, runbooks, and operational procedures for the systems you own
Bachelor's degree in Computer Science, Engineering, or equivalent practical experience
6+ years building security data pipelines, detection engineering systems, or threat intelligence platforms
Experience with Synapse or other graph-based threat intel platforms (e.g., Maltego, Neo4j), including graph data modeling
Strong programming skills in Python and/or Go
Working knowledge of static and dynamic malware analysis (disassemblers, sandboxes such as Cuckoo/CAPE, debuggers) tooling and pipelines
Experience with distributed data pipelines and message queues (Kafka, RabbitMQ) and data stores (Elasticsearch, S3, etc.)
Familiarity with containerization/orchestration (Docker, Kubernetes) for isolated execution environments
Demonstrated experience with cloud infrastructure (AWS, GCP, or Azure) designing and operating highly-available systems for critical, production-grade applications
Demonstrated use of LLM-based coding harnesses and agent-based development workflows (e.g., Claude Code, Copilot, or similar) to accelerate delivery timelines
Experience with Synapse, MISP, OpenCTI, or other TIP platforms
Familiarity with STIX/TAXII
Experience working with internet-wide scan data
Open source contributions to security tooling (YARA rules, Strelka scanners, Synapse modules)
CI/CD experience applied to detection content

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

llmpythongodockerkubernetesawsgcpazureci/cd

Platform: greenhouse
Effort: quick

Benefits

Benefits detected in the listing.

Dental

Vision

Pto

Parental Leave

Wellness

Professional Development