Security Research Engineer, Attack Surface & Risk Signals

CyberCube • San Francisco, CA

2d

About The Position

CyberCube delivers world-leading analytics to quantify digital risk, helping global carriers, reinsurers, and brokers understand, price, and manage cyber risk in financial terms. Built on AI from day one, with a blend of deep cybersecurity and insurance expertise, CyberCube is trusted by over 100 clients, including a significant portion of top European and US cyber insurance carriers and reinsurance brokers. Backed by Spectrum Equity for global growth, the company operates with a truly global team across San Francisco, New York, London, and Tallinn, fostering a culture of collaboration, openness, intellectual rigor, and ownership. This role, Quantitative Cyber Risk Engineer, is critical at the intersection of network engineering, cybersecurity, and data science. The engineer will analyze how global businesses configure their internet-facing assets and design mathematical signals to quantify their exposure to cyber attacks. The research and models will directly drive the next generation of risk-scoring and analytical engines for the cyber insurance industry.

Requirements

• Expert-level understanding of how the internet works at a foundational level, including network protocols (TCP/IP, BGP, DNS, HTTP/S, TLS), routing, ASN ecosystems, and complex enterprise network configurations.
• Proven ability to apply mathematical and statistical concepts to real-world problems, including designing quantitative metrics and building logic that scores and sizes risk exposure accurately.
• Exceptional problem-solving skills with a track record of conceptualizing complex, abstract security concepts and breaking them down into measurable data points.
• Bachelor’s or Master’s degree in Computer Science, Computer Engineering, Mathematics, Statistics, or a related highly quantitative/technical field.
• 3–5+ years of relevant work experience in network engineering, cyber threat research, risk modeling, or a related domain.

Nice To Haves

• Proficiency in Python or R to prototype algorithms and turn theoretical risk concepts into programmatic outputs.
• Experience with SQL and relational databases to pull, manipulate, and analyze large datasets of asset and configuration data.
• Familiarity with big data frameworks (Spark / Hadoop), flat files, complex data types (JSON, XML), and working with APIs.
• Experience working in or adjacent to the cyber insurance, risk modeling, or data science industries.
• Advanced technical or security certifications (e.g., CISSP, CISM, or advanced Cisco/networking certifications).

Responsibilities

• Design innovative, quantitative signals that accurately measure a company’s exposure to cyber attacks based on their network architecture, asset configurations, and internet footprint.
• Translate theoretical cybersecurity concepts and complex network topologies into empirical, actionable risk metrics and assumptions.
• Evaluate and extract meaningful insights from how organizations deploy and configure internet-facing protocols, cloud infrastructure, and enterprise networks.
• Conduct in-depth research on emerging cyber threats (e.g., critical vulnerabilities, ransomware, trending exploits, data breach techniques) and map them to underlying asset configurations.
• Serve as the subject matter expert on internet architecture, working closely with product, analytics, and engineering teams to integrate risk signals into production models.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level