Job Description
Cybersecurity Engineer - Blue Team
About the Role
Offensive AI benchmarks are everywhere. Blue-team evaluation is almost nonexistent. We're building the infrastructure to change that — credible, large-scale benchmarks for detection engineering, threat hunting, incident triage, malware analysis, and incident response.
This role is for a practitioner who has lived the blue-team workflow and can translate that experience into rigorous evaluation design.
What You'll Do
Design and build benchmark tasks grounded in real SOC and detection engineering work. Construct realistic evaluation environments — multi-host networks, Active Directory, cloud control planes — that go beyond toy single-container scenarios. Define what "correct" looks like for blue-team AI reasoning and build the infrastructure to measure it reproducibly at scale.
What We're Looking For
Hands-on blue-team experience in at least one of: detection engineering, threat hunting, incident response, or malware analysis. You know what good analyst judgment looks like, which means you can write evals that actually test it. Strong scripting and cloud/enterprise environment skills. Opinionated about what matters and why.
Why It Matters
Most AI security evals measure offense. Nobody has built a credible public benchmark for defense. If that gap bothers you, this is the role to fix it.
About Mercor
Mercor matches top global talent with leading companies. Apply through our referral network for a direct introduction.