Senior Software Engineer – OpenCRQ

THE COMPANY

Filigran, founded in October 2022, stands out in the cybertech ecosystem for its commitment to revolutionizing cyber threat management with a proactive approach. Its mission is to develop innovative open-source solutions designed to anticipate cyber threats, identify security gaps, and strengthen organizational security posture.

Filigran solutions are now trusted by over 6,000 public and private organizations worldwide.

THE ROLE

We are looking for a Senior Software Engineer who is curious about the modeling problem underneath cyber risk and wants to help shape a young product.

You will join OpenCRQ as its fourth engineer and work across the data model, backend and product surface. Many foundations are still being defined, giving you meaningful influence beyond the features you directly own.

You will shape these decisions with the squad and experienced engineering and product leaders across Filigran. We value constructive disagreement, clear reasoning and shared outcomes, and we expect everyone to ask for context, challenge assumptions and learn from one another.

THE PROBLEM YOU WOULD BE WORKING ON

Ask a CISO what a cyber risk could cost, and the answer often still begins with a color: red, amber or green, often produced by a spreadsheet disconnected from current evidence.

OpenCRQ replaces that color with a financial estimate and a traceable chain of evidence: which threat actors are active, which assets they can reach, which controls have proven effective and what the remaining exposure could cost.

Every step is computed from live data and must withstand a simple question from a board: “Where does that figure come from?” That is what makes this an engineering problem rather than a reporting one.

OpenCRQ is Filigran’s cyber risk quantification product. It combines threat intelligence from OpenCTI, exposure and control validation from OpenAEV, and agentic workflows through XTM One. As these products become more connected, the squad will define what agents can ask of the risk model, which evidence they can use and how their answers remain safe and explainable.

WHAT YOU WOULD WORK ON

– End-to-end product ownership. Take product problems from early ideation and technical design through implementation, end-to-end testing and validation with users. You will have the autonomy to drive the work, while using the squad to challenge assumptions and improve the outcome.

– The quantification engine. Turn threat frequency, control effectiveness and asset value into probabilistic loss distributions. Build general-purpose quantitative models that can evolve as assumptions and available evidence change, without losing reproducibility or explainability.

– The correlation layer. Model complex relationships across OpenCRQ, OpenCTI, OpenAEV and customer systems. Map threat intelligence, including intrusion sets, techniques, campaigns and observations, to assets, vulnerabilities, exposures and control coverage. This includes adapting OpenCRQ to open standards and schemas such as STIX and OCSF, without coupling the product to a single representation.

– Reliable ingestion at scale. Process hundreds of thousands of findings per tenant through delta syncs, long-running backfills and feeds with imperfect timestamps. You will help design observable, recoverable pipelines while extending tenant isolation as the domain grows.

– The agentic surface. Design the contracts used by XTM One agents and the plain-language explanations behind risk figures. Together, the squad will define what models can safely do in a product whose outputs inform board-level decisions.

WHAT SUCCESS COULD LOOK LIKE

Priorities will evolve with the product, but within your first 6 to 12 months you could have:

– Taken a meaningful product problem from early ideation through implementation, end-to-end testing and validation with users.

– Shaped a core part of OpenCRQ’s interconnected data model or quantification engine and documented the trade-offs behind it.

– Made a major ingestion or calculation path more observable, recoverable and reproducible.

– Defined or implemented a durable contract between OpenCRQ and another Filigran product or an open standard, without making the internal model brittle.

– Helped ship risk results that users can trace back to the evidence that produced them.

– Contributed to the open-source release and to engineering practices the growing squad can build on.

OPEN SOURCE, LIKE THE REST OF FILIGRAN

OpenCRQ is about to become Open source, alongside OpenCTI and OpenAEV. You will contribute visibly to a product whose risk calculations can be inspected, challenged and improved by the organizations running it.

THE SQUAD

You will join two senior engineers and a staff engineer, reporting to OpenCRQ’s Engineering Manager. The squad is small enough for you to influence its direction, without working in isolation.

You will collaborate with the VP of Technology, CTO and Principal Engineers on technical standards, and with the OpenCTI, OpenAEV and XTM One teams on cross-product contracts and integrations. These relationships bring domain knowledge and broader technical context into the squad’s decisions as it grows.

WHAT WILL HELP YOU SUCCEED

We do not expect you to arrive with expertise in cyber risk or every standard named below. We are looking for a strong software engineer who can learn quickly, work autonomously and use the squad to challenge and improve decisions.

– A track record of taking complex product problems from an ambiguous idea to a validated outcome: framing the problem, making technical decisions, implementing the solution, testing it end to end and checking that it solves the user’s need.

– Strong experience with a modern TypeScript stack and practical knowledge of PostgreSQL beyond the ORM. You treat failure modes and observability as part of the design.…

Source: EU Remote Jobs (https://euremotejobs.com/job/senior-software-engineer-opengrc/)