Director of Engineering, Threat Research

Horizon3

4d•$272,425 - $320,500•Remote

About The Position

Horizon3 is a fast-growing, remote cybersecurity company focused on helping organizations find, fix, and verify exploitable attack vectors before criminals exploit them. Its NodeZero platform provides production-safe autonomous penetration testing and assessment operations across internal, external, cloud, and hybrid cloud environments. The Director of Engineering, Threat Research leads the engineering organizations behind NodeZero Rapid Response and Threat Hunting. Rapid Response converts emerging vulnerability and threat signals into safe, customer-specific validation and guidance. Threat Hunting helps customers investigate whether discovered attack paths have already been used, including who gained access, where they moved, and what they did. This role owns engineering strategy, execution, and organizational health across both teams, partnering with Product, Engineering, and customer-facing groups. It also establishes a follow-the-sun vulnerability research capability with teams in Europe and Asia to provide continuous coverage while maintaining research rigor, production safety, and team health. The role requires people and portfolio leadership, with enough technical depth to set direction, improve quality, and unblock leaders while enabling managers and senior technical contributors to lead implementation. The position is remote in the US and leads distributed teams across the US, Europe, and Asia. Travel may be required up to 15%.

Requirements

Significant experience leading software engineering teams that build customer-facing products, ideally in cybersecurity or another technically complex SaaS domain.
Experience leading multiple teams and developing managers and senior technical leaders, with a record of building accountable, high-performing organizations.
Demonstrated ability to set strategy and deliver across a portfolio, translating customer and business priorities into focused roadmaps and measurable outcomes.
Experience building or scaling distributed teams and operational coverage across regions and time zones, and ability to establish sustainable 24/7 operating practices.
Strong technical judgment in software architecture, automation, data systems, and production operations, and ability to engage credibly with engineers and researchers.
Experience taking technically complex capabilities from research, prototype, or concept through reliable production delivery and ongoing improvement.
Customer-oriented product mindset and judgment balancing innovation, speed, coverage, reliability, safety, and maintainability.
Ability to build partnerships across Engineering, Product, and customer-facing teams, resolve misalignment, and communicate decisions and risks clearly.
Commitment to coaching, clear performance feedback, inclusive leadership, and healthy team culture.
Excellent written, verbal, and analytical communication skills, including explaining complex technical choices to varied audiences.
Initiative, ownership, and accountability, with comfort operating in a fast-moving environment with ambiguity.
Bachelor’s or Master’s degree in Computer Science, Engineering, Cybersecurity, or a related field, or equivalent practical experience.
Experience with production software engineering and at least one modern programming language such as Python, Go, TypeScript, or a comparable language.
Understanding of CI/CD, automated testing, observability, incident response, and operational readiness.
Ability to evaluate technical designs and establish quality controls for security-sensitive, customer-facing systems.

Nice To Haves

Deep practical experience in a relevant discipline such as vulnerability research, exploitability analysis, threat hunting, incident response, or detection engineering.
Familiarity with SOC, threat-hunting, or incident-response workflows; security telemetry; attack techniques; and frameworks such as MITRE ATT&CK.
Direct leadership experience in vulnerability research, exploit development, threat intelligence, threat hunting, incident response, or security product engineering.
Experience building or operating AI/LLM-assisted research, analysis, or security workflows, including evaluation and verification practices.
Experience building follow-the-sun teams or leading global, time-sensitive operations.
Contributions to vulnerability research, published advisories, open-source tooling, technical publications, or conference talks.
Familiarity with reverse engineering or languages such as C, C++, Rust, or Assembly.
Experience working with cloud environments and large-scale software products.

Responsibilities

Lead and develop the engineering organizations for Rapid Response and Threat Hunting, establishing ownership, goals, operating expectations, and measurable outcomes.
Define engineering strategy and roadmaps that connect customer needs, product priorities, security research, and long-term engineering investments across both teams.
Build the leadership structure to scale, including hiring, coaching, and developing engineering managers, technical leaders, and senior individual contributors.
Own organizational health, including talent planning, career development, feedback, performance, retention, and succession planning.
Establish operating mechanisms that make priorities, delivery, capacity, dependencies, quality, and risks visible without unnecessary process.
Foster an inclusive, psychologically safe culture with high standards for technical rigor, accountability, collaboration, and learning.
Lead Rapid Response engineering strategy and build automation and AI-assisted research workflows that accelerate analysis and test development while preserving expert judgment, verification, and safety controls.
Partner with Product, Design, and Engineering to connect asset and exposure context, technology fingerprints, patch information, and other signals to timely, precise customer notifications.
Build and lead a follow-the-sun vulnerability research organization with sub-teams in Europe and Asia, including staffing models, regional ownership, handoffs, escalation paths, shared queues, and playbooks.
Recruit and develop vulnerability researchers and leaders across regions; establish onboarding, career paths, knowledge-sharing practices, and succession plans.
Lead the engineering direction for NodeZero Threat Hunting, including agent and product capabilities that help customers understand access, movement, and impact.
Partner with Product, Design, and technical leaders to turn threat-hunting, SOC, and incident-response needs into scalable investigation workflows and customer-facing capabilities.
Guide the use of security telemetry, attack context, detection logic, and data integrations to produce useful, explainable investigative results.
Establish quality, reliability, observability, and evaluation practices that help customers trust evidence and act on findings.
Ensure Threat Hunting fits into the NodeZero experience and customer security workflows, including appropriate APIs and integrations.
Partner across Product, Engineering, Platform, Data, Marketing, Customer Success, Sales, and Channel to translate opportunities into sequenced plans with explicit outcomes and ownership.
Drive cross-team initiatives from discovery through production, surfacing dependencies and risks early and aligning stakeholders on tradeoffs and decisions.
Maintain technical judgment across software architecture, research automation, data-intensive systems, product quality, and operational readiness without becoming a day-to-day decision bottleneck.
Ensure strong engineering practices across design, implementation, testing, release, monitoring, incident response, and learning from production issues.
Use customer feedback, product behavior, research outcomes, and field signals to assess impact and continuously improve the organization’s work.
Help teams communicate emerging-threat findings and product capabilities clearly to technical and non-technical audiences.