The Role

GreyNoise is hiring a Detection Engineer to own the high-volume, foundational detection work that keeps our datasets accurate and our customers protected. This role is intentionally focused on operational execution: building, validating, and maintaining detections at scale.

Responsibilities:

Detection and Traffic Tagging Operations

• Write and tune Intrusion Detection System rules grounded in observed network behavior.
• Maintain and improve tag coverage and quality: adding new tags, fixing broken ones, and de-duplicating overlaps.
• Maintain benign actor classifications and known-scanner lists so non-malicious traffic is accurately labeled.
• Resolve accumulated detection issues that degrade data quality for users and customers.
• Use internal CLI tooling to lint, test, and deploy detection rules and tags at scale.
• Read and analyze packet captures (pcaps) and related network artifacts during routine validation and debugging.
• Validate detections against real traffic and own the trade-offs between false positives and false negatives for individual rules.

Triage and Pipeline Hygiene

• Triage a steady stream of inbound detection requests, CVEs, and internal coverage questions. The team processes dozens of new items weekly.
• Ensure detections are wired correctly end-to-end: from raw data through rule logic to tag output.
• Flag edge cases, collisions, and unexpected behavior in tags or rules for deeper follow-up.

Collaboration

• Work closely with researchers to keep them focused on longer-horizon projects.
• Communicate clearly about what you are working on, blockers, and trade-offs when priorities shift.
• Help sales, support, and customer success get faster, clearer answers on detection coverage questions.

What Success Looks Like

• The backlog of smaller yet important detection work stops growing and quietly gets handled.
• Tag and detection coverage feels predictable and systematic rather than ad hoc.
• Internal teams get faster, clearer answers on coverage questions.
• The rest of the research team has noticeably more uninterrupted time for complex work and bigger bets.
• You develop reliable instincts for which detection issues matter most and can prioritize without constant direction.

Who This Role Is Good For

We are flexible on the level. This could be filled by someone in early to mid-career or by a senior practitioner willing to own operational detection work as a primary focus, with a possible path toward deeper research responsibilities over time.

Early-Career or Mid-Level

• Comfortable with networking fundamentals and common protocols.
• Can read pcaps today, or is eager to get to "pcaps in your sleep" quickly.
• Understands basic security concepts: CVEs, exploit vs. vulnerability, false positives vs. false negatives.
• Thrives on clear queues of work and shipping lots of small, concrete things.
• Wants broad exposure to real-world internet traffic and detection engineering.

Senior

• Strong background in detection engineering, DFIR, SOC operations, or network security.
• Sees operational detection work as the foundation for credible research, not a stepping stone past it. Expect to own this for 6 to 9+ months before the role naturally expands.
• Can turn vague problems into scoped, repeatable workflows.
• Understands that high-leverage impact often comes from unglamorous, highly reliable execution.

Required Skills

• Demonstrated ability to read and analyze packet captures (pcaps).
• Experience writing or maintaining Suricata rules or similar network detection signatures.
• Comfort with high context-switching: moving between tags, rules, pcaps, and internal requests throughout the day.
• Strong attention to detail; small mistakes in tags or rules have outsized downstream effects.
• Clear, concise written communication, especially when something is broken, ambiguous, or blocked.

Nice to Haves

• Experience with IDS/IPS platforms, Suricata, Zeek, Sigma, Nuclei, or Snort.
• Prior exposure to large-scale internet telemetry, threat intelligence feeds, or SOC operations.

A Few of our GreyNoise Labs Principles

• Honesty
  • Put your best understanding of the truth first in all that you do.
• Decency
  • Treat yourself and others with respect.
• Opinions
  • Frame opinions using data or experience; they are still opinions.
• Computers
  • Computers are cool, but that doesn’t mean you won’t hate them.

The Role

GreyNoise is the first line of defense for our customers when it comes to emergent threats involving mass exploitation. Our actor, action, and source IP intelligence enables security teams to confidently block active malicious campaigns, triage alerts to reduce Security Operations Center (SOC) overload, and buy time to patch or mitigate critical weaknesses. The Security Research and Detection Engineering team members are responsible for ensuring we have Day-0 coverage for new vulnerabilities. They are also charged with neutralizing the chatter around "celebrity" vulnerabilities that are, essentially, nothing-burgers.

What You Will Do

• Lead the function and team for Security Research for GreyNoise
• Build and manage a team of exceptional security researchers
• Be the leader for innovation in cybersecurity research and at-scale detection engineering at GreyNoise.  GreyNoise packet captures the Internet every second of every day, and you will lead an expert team of researchers turning billions of packets into accurate, unique, and actionable threat intelligence.
• You’ll forge expert novel research into powerful practitioner information at conferences, in publications, and throughout the GreyNoise platform.
• Collaborate with Product, Engineering, Sales, Marketing and Customer Success to align the team's mission and priorities with business plans and goals.
• Represent GreyNoise as one of the key faces and voices of our research, communicating our insights, observations, and innovations through community engagement, social media, blog posts, research papers, conferences, media interactions, and direct communication to customers.
• Forge and manage partnerships with key government and industry researchers to ensure GreyNoise remains at the forefront of new developments.

Finally and most importantly you will mentor, coach, and grow with one of the most respected and knowledgeable teams of internet researchers and cybersecurity practitioners in the industry.

What You Will Bring

A culture-first, team-first attitude to everything you do.  The successful candidate will have demonstrated leadership and expertise in core cybersecurity areas, including:

• SOC tools, processes, and needs
• Red, Blue, and Purple Team operations
• Novel threat and vulnerability research
• Detection Engineering
• Automation-, AI-, and event-driven processes that work at speed and scale
• Tracking emergent threats, novel TTPs, and threat actors
• Strong communication skills in both small team and big room environments
• A solid track record of building, managing and growing fully remote teams
• Worked with government organizations on cyber projects

Nice To Haves 

• A history of creating or contributing to cyber-focused open-source projects
• Experience interfacing with tech and mainstream media outlets (a.k.a. "media training")
• Experience in conceptualization and production of customer- and community-focused reports.
• Strong reading comprehension as it relates to RFC’s and other written technical artifacts
• Familiarity with standard industry network analysis tooling
• Experience with large-scale distributed internet data collection, experience with attacker techniques

A Few of our Engineering Principles

• Deliver fast, deliver often.
• Tech is cheap, don't be afraid to throw it away.
• Don’t be afraid to change anything that already exists.
• Technical compromises are good.
• Utility and adoption are always factored into success criteria.

A Few of our Research Principles

• Honesty - Put your best understanding of the truth first in all that you do.
• Decency - Treat yourself and others with respect.
• Opinions - Frame opinions using data and experience, but remember they are still opinions.
• Computers - Computers are cool, but that doesn’t mean you won’t hate them.

GreyNoise Culture

• Be transparent, honest, and objective.
• Empathize with customers, partners, and each other.
• Learn from mistakes and share the knowledge.
• The way feedback is delivered to one another matters as much as the feedback itself.
• Good work-life balance is the key to sustained productivity,
• The measure of a team member’s effectiveness is how well the rest of the team operates in their unexpected absence.
• No such thing as a million-dollar idea, only million dollar execution.
• Out-innovate our previous selves.

The Role

The GreyNoise Customer Success Manager - Federal (CSM) is a part of the GreyNoise Customer Experience (CX) team, which provides our customers with an industry-leading experience. This is a customer-centric position focused on ensuring our customers' success with GreyNoise is all but guaranteed. The CSM will be the customer's primary contact and will facilitate all customer needs with the rest of the GreyNoise organization. The CSM will also be responsible for retaining our customers and ensuring continued success with all GreyNoise services.

This position will report to the Senior Director of Customer Experience.

What You Will Do

• Interact with GreyNoise customers (Federal, Public Sector and Global Gov’t) regularly, which includes but is not limited to:
• Build relationships with Primary Contacts (PC) at customer organizations within your assigned portfolio
• Work with PCs to define success criteria and track outcomes
• Conduct regular check-in calls with portfolio customers to check on current status, review product usage, discuss additional use cases, and review the upcoming GreyNoise roadmap
• Answer inbound emails from customers or redirect them to an appropriate contact and ensure a timely response
• Ensure regular communications with portfolio customers
• Capture customer feedback and issues
• Coordinate onboarding and handoff (Sales to CX) of new customers
• Track all interactions with customers in the GreyNoise CRM
• Track usage and successful adoption of GreyNoise products by customers
• Act as the customer advocate within GreyNoise to ensure customer needs and requests are reviewed and responded to in a timely manner.  Requires working closely with the GreyNoise Product Team to correctly capture and scope customer requests as required by the Product team
• Handle customer subscription renewals by coordinating quotes and collaborating with procurement teams.  This includes responding to and filling out RFPs and other contracting vehicles necessary to facilitate these renewals
• Engage with the Sales team to work on customer expansion opportunities and facilitate all communications with appropriate customer stakeholders
• Interact regularly with all GreyNoise internal teams to communicate customer needs, get updates, and pull other relevant team members into customer interactions when needed

What You Will Bring

• At least 5 years of experience providing Customer Success for a SaaS solution, preferably in the Cyber Security industry
• Prior experience working with Federal and Public Sector organizations
• A passion for providing customers with an experience that is outstanding and builds long-lasting relationships
• The ability to work independently while managing customer accounts, and also as a team to ensure successful communication and outcome achievement.  The goal is to allow the CSM to work independently to manage their portfolio while ensuring the other teams are up to date on each customer's status and can support CXS/Customer needs.
• The ability to manage a large portfolio of global customers (ie. Must be willing to support globally)
• Exceptional written and oral communication skills. This role requires an ability to understand and articulate both the business benefits (value proposition) and technical advantages of GreyNoise.
• Exceptional organizational skills and the ability to properly track and organize interactions with a large number of customers
• Quick learner with good technical and problem-solving skills

Nice to Haves

• Generally familiar with cybersecurity terminology and concepts
• Familiarity with Hubspot, Linear, Notion, Slack, Github Issues, and Metabase
• Familiarity with reviewing business intelligence and product usage metrics regularly
• Located in the DC metro area

A Few of Our Customer Experience Principles

• Customers should love working with us, and if they don’t, we need to understand why and do our best to improve
• The customer isn’t always right, but we should always listen and be respectful of what they are asking and make our best effort to find a solution
• We are going to lose customers, but when we do, be sure to: Be Clinical about the experience, Identify what we could have done better, and Identify if it could have been prevented