Senior Security Analyst

Why this role matters now

SpartanX is building the autonomous offensive security platform: hundreds of AI agents that attack a customer's web, API, network, cloud, identity and AI surfaces the way a real adversary would, continuously and at scale. We are a product company, not a services firm, and the product is the business.

Our engineers are excellent builders. But many of the decisions inside a security platform are not engineering decisions. They are security judgments. Is this finding real? How severe is it, really, in this environment? How likely is it to be exploited? What should be fixed first, and how? What threats does this architecture introduce? Getting those answers right, consistently and at scale, is what separates a trusted platform from a noisy one.

You will be the security brain inside engineering. Your expertise becomes the logic the platform runs on.

Your mission

Raise the accuracy and credibility of everything SpartanX tells its customers about risk. You will define the security methodologies the platform applies, translate them into precise requirements engineers can build, and measure whether the results hold up against expert judgment and real-world evidence.

You will be measured on outcomes: how accurate, well-prioritized and actionable our security outputs are, and how much faster engineering moves because the security questions have clear answers.

What you will own

Security domain authority for engineering

• • Be the go-to expert engineers rely on when a question needs a security answer, not a coding answer.
• • Translate security knowledge into precise requirements, rules, decision logic and acceptance criteria that engineers can implement and test.
• • Review designs and implementations for security correctness before they reach customers.

Risk scoring and prioritization

• • Define, document and calibrate how risk is scored and prioritized, combining severity, exploitability, threat intelligence, asset criticality and business context.
• • Know when CVSS alone is misleading, and design approaches that use EPSS, CISA KEV, SSVC and real exploitation evidence to rank what actually matters.
• • Validate scoring against real cases, and explain every rating in a way a CISO would accept.

Vulnerability analysis and classification

• • Interpret findings from many sources and decide what is real, what is a duplicate and what is noise.
• • Classify and map vulnerabilities and attack behavior consistently to CWE, CVE, CAPEC, MITRE ATT&CK and OWASP.
• • Define the taxonomies and normalization rules that keep that classification consistent at scale.

Threat modeling

• • Bring deep, hands-on threat modeling expertise: decomposing systems, identifying trust boundaries and data flows, and systematically enumerating threats.
• • Apply and adapt methodologies such as STRIDE, PASTA, LINDDUN and attack trees to real architectures and applications.
• • Lead threat models of our own platform and help the team practice threat modeling consistently, with clear quality criteria.

Remediation guidance

• • Define what good remediation guidance looks like: specific, prioritized, technically correct and realistic for the team that has to apply it.
• • Reason about fixes, compensating controls and risk acceptance trade-offs.
• • Map remediation to security and compliance controls (NIST, CIS, ISO 27001, PCI DSS, SOC 2) when customers need that evidence.

Accuracy, evaluation and quality

• • Build ground-truth datasets, benchmarks and review criteria to measure the accuracy of the platform's security outputs, including those produced by AI.
• • Track false positives and false negatives, find their root causes and drive fixes with engineering.
• • Create the feedback loops that make the platform measurably more accurate release after release.

Raising the security bar of the team

• • Grow the security literacy of our engineers through reviews, documentation and short, practical sessions.
• • Write the internal references the team will use for years: scoring guides, classification standards and threat modeling playbooks.

What you need to know

This is a senior role and the bar is broad and deep. We expect strong, hands-on command of the areas below and the judgment to know when each framework helps and when it misleads.

Cybersecurity foundations

• • Broad command of cybersecurity: application, API, network, cloud, identity, endpoint and AI/LLM security, and how attacks chain across them.
• • Offensive understanding: how real attackers find, exploit and chain weaknesses, and how that differs from what scanners report.

Risk management

• • Risk frameworks and methods: NIST RMF and NIST CSF, ISO 27005, and quantitative approaches such as FAIR.
• • Business context: asset criticality, data sensitivity and business impact, and how they change the priority of a technical finding.

Vulnerability scoring and intelligence

• • CVSS v3.1 and v4.0: in depth, including environmental and threat metrics, and their limits.
• • EPSS, CISA KEV and SSVC: how to combine exploit likelihood, known exploitation and decision trees into prioritization.
• • Vulnerability intelligence sources: NVD, vendor advisories, exploit databases and threat intelligence feeds.

Taxonomies and frameworks

• • CWE, CVE and CAPEC.
• • MITRE ATT&CK (Enterprise, Cloud) and MITRE D3FEND.
• • OWASP: Top 10, API Security Top 10, Top 10 for LLM Applications, ASVS and the Testing Guide.

Threat modeling

• • Methodologies: STRIDE, PASTA, LINDDUN, attack trees and kill chain analysis.
• • Techniques: data flow diagrams, trust boundaries, abuse cases and attack path analysis.
• • Inputs: working from architecture documentation, diagrams, infrastructure definitions and source code.

Remediation and controls

• • Secure design and coding patterns, and practical fixes for common vulnerability classes.
• • Control frameworks: NIST SP 800-53, CIS Controls and Benchmarks, ISO 27001, PCI DSS and SOC 2.

The cross-cutting skills

• • Precision in writing: you can turn expert judgment into rules and criteria clear enough for an engineer to implement and a test to verify.
• • Skepticism: you question scores, sources and outputs, including your own.
• • Explicit trade-offs: knowing when “good enough” is the right answer, and saying so.
• • Communicating risk to engineers, executives and customers, each in their own language.

Who you are

What you bring

• • 7+ years in cybersecurity, with deep hands-on experience in at least two of: vulnerability management, application security, penetration testing or red teaming, threat modeling, and security architecture.
• • Threat models you have led yourself, on real systems, from decomposition to prioritized threats and mitigations.
• • Experience designing or operating vulnerability prioritization and risk scoring at scale, beyond copying the CVSS base score.
• • Experience working closely with software engineering teams, and comfort reading code, APIs and infrastructure definitions.
• • Clear, precise writing in English. In a distributed team, written standards and decisions are how we stay aligned.
• • Comfort with ambiguity, speed and the trade-offs of an early-stage company.

What will set you apart

• • Experience at a security product company, defining the security logic of a product rather than only operating tools.
• • Experience evaluating or improving the security outputs of AI or LLM-based systems.
• • Offensive certifications or equivalent experience (OSCP, OSWE, GPEN, GWAPT), or broad ones such as CISSP or CSSLP.
• • Scripting skills (Python) to analyze findings data and build datasets.
• • Experience with quantitative risk (FAIR) or with compliance-driven security testing (PCI DSS, SOC 2, DORA).
• • Contributions to OWASP, MITRE or other community security projects.

Read this before you apply

This role is not for everyone, and we would rather say so up front.

• • It is not a SOC, GRC or pentest delivery role. You will not work a queue or deliver reports. Your work becomes the logic of a product used by many customers.
• • You will work like an engineer. Backlogs, specs, reviews and releases. Your opinions need to become precise, testable definitions.
• • The bar is high. You will work alongside founders who have built and sold a security company before, and a research team that breaks into systems for a living. Credibility is earned through substance.
• • The pace is fast. AI is reshaping offensive security month by month, and our platform moves with it.

Why take it anyway. Few roles let a security expert shape how an entire platform thinks about risk. Your judgment will reach every customer we serve, with the ownership and equity of an early team member.