[All remote jobs](https://jobicy.com/jobs.md)[![Socket logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1314ce3c-221.png)](https://jobicy.com/company/socket.md)[Socket](https://jobicy.com/company/socket.md) # Threat Researcher Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/socket.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 126k–170k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceEntry-Level, JuniorPublished24 Oct 2026Apply before23 Nov 2026Listing views49Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. Socket is seeking an experienced Threat Researcher to investigate software supply-chain threats affecting open-source ecosystems. The role combines malware analysis, reverse engineering, threat intelligence, detection engineering, and proactive threat hunting across package registries, extensions, and code-hosting platforms. The researcher will build automation tooling, publish technical research, track APT activity, and work with engineers to convert findings into product protections. This is a senior hands-on security research position requiring strong technical judgment, clear written communication, and ownership in a remote-first US team. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThe role requires broad and deep expertise spanning malware analysis, forensics, incident response, threat hunting, automation, and open-source ecosystems. Daily threat analysis and the expectation to turn novel findings into scalable defenses create a demanding, high-urgency workload. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$148,000US market range (per year)$125k–$185k0$203.50k AI insightSocket discloses an annual base salary range of $126,000–$170,000 USD. The midpoint is $148,000 per year, which is broadly credible for an experienced US-based software supply-chain threat researcher. Estimated US market compensation for comparable roles is approximately $125,000–$185,000 annually; this is an AI estimate rather than verified salary research. ## Core skills Skills and capabilities most closely associated with this opportunity. [Threat intelligence](https://jobicy.com/jobs?search_keywords=Threat%20intelligence.md)[Malware analysis](https://jobicy.com/jobs?search_keywords=Malware%20analysis.md)[Reverse engineering](https://jobicy.com/jobs?search_keywords=Reverse%20engineering.md)[Threat hunting](https://jobicy.com/jobs?search_keywords=Threat%20hunting.md)[Digital forensics](https://jobicy.com/jobs?search_keywords=Digital%20forensics.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[Detection engineering](https://jobicy.com/jobs?search_keywords=Detection%20engineering.md)[Software supply chain security](https://jobicy.com/jobs?search_keywords=Software%20supply%20chain%20security.md)[Open-source security](https://jobicy.com/jobs?search_keywords=Open-source%20security.md)[Python scripting](https://jobicy.com/jobs?search_keywords=Python%20scripting.md)[TypeScript](https://jobicy.com/jobs?search_keywords=TypeScript.md)[TTP analysis](https://jobicy.com/jobs?search_keywords=TTP%20analysis.md)[APT tracking](https://jobicy.com/jobs?search_keywords=APT%20tracking.md)[Security automation](https://jobicy.com/jobs?search_keywords=Security%20automation.md)[Technical writing](https://jobicy.com/jobs?search_keywords=Technical%20writing.md) Sample interview questionsHow would you investigate a newly identified suspicious package in a public package registry?I would first preserve package artifacts and metadata, identify version history, maintainers, dependencies, install scripts, and download patterns. I would statically inspect code for obfuscation, credential theft, persistence, command execution, and exfiltration behavior, then detonate it safely if needed. Finally, I would document indicators, map behavior to MITRE ATT&CK where appropriate, assess blast radius, and create detection or blocking logic. Describe an automation tool you would build to improve malware-analysis throughput. I would build a pipeline that ingests package metadata and artifacts, performs unpacking and normalization, extracts indicators and suspicious behavioral features, runs static rules, and prioritizes samples by risk score. The pipeline would store results in a searchable dataset and generate analyst-ready reports, while allowing researchers to add rules and feedback that improve future triage. How do you distinguish malicious behavior from legitimate but unusual open-source package behavior? I evaluate behavior in context: the package purpose, maintainer history, release changes, dependency graph, install-time actions, permissions, network destinations, and consistency with documentation. I seek corroborating evidence such as hidden payloads, deceptive naming, obfuscation, credential access, unexpected data exfiltration, or campaign infrastructure. I also validate conclusions through reproducible analysis and peer review before assigning high-confidence malicious labels. How would you turn a threat-research finding into a scalable product capability? I would convert the research into durable signals such as behavioral rules, indicators, package reputation features, dependency-graph patterns, or detection heuristics. I would work with engineering to define detection precision, false-positive handling, performance requirements, and telemetry needed for validation. After deployment, I would monitor outcomes, refine the logic, and publish customer-facing guidance when appropriate. What makes a high-impact technical threat-research report? A strong report clearly explains what happened, why it matters, who is affected, and what concrete actions readers should take. It includes reproducible technical evidence, relevant indicators, attack flow, affected ecosystems, confidence levels, and limitations. It should be accurate enough for defenders to operationalize while remaining understandable to technical stakeholders outside the research team. Opportunity details ## About this role. About Us Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our customers – from Anthropic to xAI, and Figma to Vercel – love Socket (just [check out their tweets](https://socket.dev/love) to see for yourself!) Founded by [Feross Aboukhadijeh](https://www.linkedin.com/in/feross/), a long-time open source maintainer with software downloaded over a billion times a month, Socket has raised [$](https://socket.dev/blog/series-b)[125M in funding](https://socket.dev/blog/series-c) from top angels, operators, and security leaders. About the Role Socket is looking for a Threat Researcher to join our growing Threat Intelligence Team. In this role, you’ll tackle cutting-edge threats in the software supply chain, leveraging our proprietary AI-based scanner and building tools to enhance malware analysis. You’ll secure open source ecosystems, strengthen threat detection across multiple programming languages, and conduct research that helps protect developers and organizations worldwide. This is not an entry-level position. This is a hands-on role for someone passionate about threat hunting, security research, automation, and turning insights into actionable defenses. What You’ll Do * Analyze numerous unique threats daily, maintaining a standard of quality that sets the industry benchmark for supply chain security. * Author high-impact technical blog posts on malicious open source code packages and extensions, and publish deep-dive research pieces on malicious campaigns, threat actor profiles, novel attack vectors, and ecosystem-wide trends. * Design and build automated scripts and tools to streamline malware analysis, enhancing our data collection, threat analysis, and threat hunting workflows. * Partner with our engineering team to integrate your research into our core product, turning manual insights into scalable, real-time protection. * Leverage expertise in open source software ecosystems to enhance security across package registries, browser extensions (Chrome/VS Code), and proactively monitor GitHub/GitLab for emerging malicious campaigns. * Track APT (Advanced Persistent Threat) adversaries, characterizing various TTPs (Tactics, Techniques, and Procedures), capabilities, infrastructure, and campaigns. What You’ll Bring Required: * 3+ years of work experience and a master’s degree in computer science, engineering, or a related field (or equivalent experience). * Technical experience across several areas of security operations, including investigations, incident response and management, digital forensics, malware analysis, reverse engineering, threat intelligence, threat hunting, and detection engineering. * Excellent communication skills and the ability to assess the relevance and impact of threats. * Experience building tools for automation, data collection, and threat hunting. * Passion for open source and code. Preferred: * Familiarity with TypeScript/JavaScript and/or other programming languages and ecosystems protected by Socket. * Experience leveraging LLMs or AI-based tools for threat detection. Hiring is a big decision on both sides. Read more about our [Hiring Philosophy](https://socket.dev/hiring-philosophy)and how we approach the process at Socket. Benefits: Our benefits are crafted to support you and your family, so you can take care of what matters most and thrive in and outside of work. We offer: * Market competitive salary bands * Meaningful equity program * Comprehensive health benefits for you and your family (99% coverage) * Flexible time-off, holidays, and winter shutdown to rest & recharge * Paid parental leave * Remote-first, with quarterly team off-sites At Socket, we * Pursue Excellence: We set ourselves apart by consistently delivering work of exceptional quality and distinction. * Move with urgency and focus: We prioritize swift, decisive action. * Think rigorously: We care about being right and it often takes reasoning from first principles to get there. We value alternative perspectives and have constructive discussions. * Trust and amplify: We overtrust, always assume good intent, and give specific feedback to help each other improve. * Feel a strong sense of ownership: We wear many hats and feel a strong sense of overall ownership of the company and we’re non-territorial regarding our nominal domains. * Are customer obsessed: We relentlessly prioritize the needs of our customers, striving to exceed their expectations and delight them at every interaction. Show more [Apply now >](https://jobicy.com/jobs/156770-threat-researcher.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Twilio logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/WRILS-201023175858-722503.jpg) Twilio Oct 24 New ### [Security Engineer, Incident Response](https://jobicy.com/jobs/156851-security-engineer-incident-response.md) Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of businesses and empower… * ![Zscaler logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/b3234031-221.png) Zscaler Oct 24 New ### [Senior Partner Engineer](https://jobicy.com/jobs/156842-senior-partner-engineer.md) Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange platform protects thousands of customers from cyberattacks and data… * ![1Password logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200909195848-296323.png) 1Password Oct 24 New ### [Developer Intern, Data Security – Winter 2027](https://jobicy.com/jobs/156809-developer-intern-data-security-winter-2027.md) 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up… * ![Ping Identity logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/09/63e8d5a6-221.png) Ping Identity Oct 24 New ### [Manager, Cyber Security](https://jobicy.com/jobs/156790-manager-cyber-security.md) About Ping Identity: At Ping Identity, we believe in making digital experiences both secure and seamless for all users, without compromise. We call this digital freedom. And it’s not just… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 24 New ### [Manager, Security Operations Center](https://jobicy.com/jobs/156765-manager-security-operations-center.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Tines logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/9285d376-221.png) Tines Oct 24 New ### [Professional Services Engineer II](https://jobicy.com/jobs/156726-professional-services-engineer-ii.md) Tines is the intelligent workflow company that powers some of the world’s most important workflows. Tines has been supporting IT and security teams from a diverse range of customers, including… * ![Zscaler logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/b3234031-221.png) Zscaler Oct 24 New ### [Principal AI Security Specialist, BeNeLux & Nordics](https://jobicy.com/jobs/156714-principal-ai-security-specialist-benelux-nordics.md) Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange platform protects thousands of customers from cyberattacks and data… * ![Zscaler logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/b3234031-221.png) Zscaler Oct 24 New ### [Principal AI Security Specialist, UK&I](https://jobicy.com/jobs/156716-principal-ai-security-specialist-uki.md) Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange platform protects thousands of customers from cyberattacks and data… * ![Tenable logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01879e02-221.jpg) Tenable Oct 24 New ### [Associate Services Architect](https://jobicy.com/jobs/153962-associate-services-architect.md) Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent… * ![Canonical logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/b4d068a9-221-1.png) Canonical Oct 24 New ### [Ubuntu Security Engineer](https://jobicy.com/jobs/149565-ubuntu-security-engineer.md) Canonical is a leading provider of open source software and operating systems to the global enterprise and technology markets. Our platform, Ubuntu, is very widely used in breakthrough enterprise initiatives… [Browse all jobs](https://jobicy.com/jobs.md)