> Markdown version of [/jobs/ext/4625227-systems-engineer](https://www.wearedevelopers.com/jobs/ext/4625227-systems-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Systems Engineer - **Company:** REMOTE - **Location:** San Francisco, CA, United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Amazon S3, Systems Engineering, Microsoft Azure, Cloud Computing, Computer Programming, Continuous Integration, Data Stores, Digital Architecture, Distributed Data Store, Dynamic Program Analysis, Elasticsearch, Intrusion Detection and Prevention, Python (Programming Language), Neo4j, Open Source Technology, Queueing Systems, RabbitMQ, Microsoft Copilot, Data Logging, Large Language Models, Claude Code, Malware, Cyber Threat Analysis, Containerization, Kubernetes, Information Technology, Apache Kafka, Data Pipelines, Docker - **Published:** November 7, 2026 - **Apply:** https://www.juju.com/job/28_25303_5e4b8a8be0585f8adc1c00ca56ddc52e ## About the Role * Bachelor's degree in Computer Science, Engineering, or equivalent practical experience * 6+ years building security data pipelines, detection engineering systems, or threat intelligence platforms * Experience with Synapse or other graph-based threat intel platforms (e.g., Maltego, Neo4j), including graph data modeling * Strong programming skills in Python and/or Go * Working knowledge of static and dynamic malware analysis (disassemblers, sandboxes such as Cuckoo/CAPE, debuggers) tooling and pipelines * Experience with distributed data pipelines and message queues (Kafka, RabbitMQ) and data stores (Elasticsearch, S3, etc.) * Familiarity with containerization/orchestration (Docker, Kubernetes) for isolated execution environments * Demonstrated experience with cloud infrastructure (AWS, GCP, or Azure) designing and operating highly-available systems for critical, production-grade applications * Demonstrated use of LLM-based coding harnesses and agent-based development workflows (e.g., Claude Code, Copilot, or similar) to accelerate delivery timelines, * Experience with Synapse, MISP, OpenCTI, or other TIP platforms * Familiarity with STIX/TAXII * Experience working with internet-wide scan data * Open source contributions to security tooling (YARA rules, Strelka scanners, Synapse modules) * CI/CD experience applied to detection content * Familiarity with SOC 2, ISO 27001, or similar security/compliance frameworks as they relate to handling sensitive data * Hands-on experience authoring and managing YARA rules at scale * Experience with Strelka or comparable file scanning frameworks (e.g., Assemblyline, FAME) This position is located fully remote with no expectations to come into an office regularly. For high cost of living areas in the US (San Francisco / Seattle / NYC), the expected salary range for this position is $190,000 - $240,000 USD, plus bonus eligibility and equity. For all other locations in the US, the expected salary range for this position is $170,000 USD - $220,000 USD, plus bonus eligibility and equity. For candidates being considered outside of the US, location specific market data will be evaluated and discussed during the interview process. Job level and actual compensation will be decided based on factors including, but not limited to, individual qualifications objectively assessed during the interview process (including skills and prior relevant experience, potential impact, and scope of role), market demands, and specific work location. The listed range is a guideline, and the range for this role may be modified. For roles that are available to be filled remotely, the pay range is localized according to employee work location by a factor of between 83% and 100% of range. Please discuss your specific work location with your recruiter for more information. ## Description * Design, build, and maintain static and dynamic file analysis pipelines capable of processing artifacts at scale * Maintain, and optimize YARA rule sets, including tooling for rule testing, performance, and false-positive management * Operate and extend threat indicator enrichment systems for real-time file metadata extraction, scanning, and enrichment * Build and grow threat graph intelligence systems, modeling relationships between indicators, malware, infrastructure, and actors * Design and maintain dynamic analysis (sandboxing/detonation) capability, including behavioral telemetry collection and safe execution environments * Build ingestion and normalization pipelines connecting internal Censys scan data with external threat intel feeds * Instrument pipelines for reliability and observability (logging, monitoring, alerting, SLAs) * Partner with threat research and detection engineering teams to translate analytical needs into scalable systems * Maintain secure handling and isolation practices for malicious samples and analysis environments * Document architecture, runbooks, and operational procedures for the systems you own, To ensure the integrity of our hiring process and in attempt to facilitate a more personal connection, we require all candidates to keep their cameras on during video interviews. You may also be required to meet a Censys employee at one point during your process. Additionally, if hired, you will be invited to visit Ann Arbor, Michigan for in-person onboarding.