Malicious Network Activities Expert

Location: Fort Meade
Status: Remote
Clearance Level: TS/SCI
Education: Bachelor's degree in Network Security, Information Technology, or related field
Salary: $100,000-$135,000
Benefits: Competitive salary and bonus structure, Comprehensive health insurance, 401(k) with company match, Generous PTO and remote work options.
Application: apply here, or on our Careers Page @ Careers - Metronome, or email your resume to r.derring@wearemetronome.com

Description: We are seeking an experienced and detail-oriented Malicious Network Activities Expert to support the evaluation of large language models (LLMs) in the domain of network security. This role involves developing challenging and realistic test materials that assess an LLM's ability to understand and reason about malicious network behavior. The ideal candidate will have hands-on experience analyzing network traffic, identifying attack signatures, and crafting scenarios that mirror real-world threat patterns. You will be responsible for generating packet captures, designing unencrypted traffic scenarios, and creating question-answer pairs that test the model's ability to detect anomalies, recognize protocol misuse, and infer exploit behavior from network evidence. This position requires a strong foundation in network protocols, threat detection, and offensive security tooling.

* 4+years in network security analysis or intrusion detection

Create question-answer pairs that test models on detecting malicious network activities

* Design scenarios involving unencrypted traffic analysis

* Develop examples that require pattern recognition in packet content

* Craft challenges that test understanding of request-response dynamics

* Create prompts that involve protocol-specific anomaly detection

* Generate packet captures of known exploits and test if models can identify the specific exploit or vulnerability

* Strong background in network security and traffic analysis

* Experience with common attack patterns and their network signatures

* Understanding of network protocols and their normal vs. abnormal behaviors

* Familiarity with packet analysis tools (e.g., Wireshark)

* Proficiency with exploitation frameworks (e.g., Metasploit, etc.) to generate realistic attack traffic

* Ability to capture and document network traffic containing specific vulnerabilities

* Knowledge of cybersecurity threat detection methodologies

* Ability to create realistic but challenging scenarios that test semantic understanding

The ideal candidate should be able to create evaluation materials that test a model's ability to perform real-time analysis of network traffic patterns. They should specifically be able to generate packet captures of known exploits using tools like Metasploit, then develop prompts that challenge the model to "work backward" from the traffic patterns to identify the specific exploit or vulnerability being leveraged in the attack.