What the engagement actually is

This is a research engagement, not a data-labeling gig. You sit on video with Mercor's benchmark team for two to three one-hour sessions spread over roughly four weeks, scheduled around your calendar. The conversations are structured but not scripted: what lands in your queue on a normal Tuesday, which tools you live inside, how your team decides whether a triage was correct or a detection rule was well-written, and where AI assistance currently helps versus where it produces confident nonsense you have to unwind. In later sessions you are shown a draft task taxonomy and asked to argue with it — what is missing, what is mislabeled, what you would weight differently if the goal is to separate competent agents from plausible-sounding ones.

What the screen is looking for

The platform screen is checking that you are close enough to the keyboard to speak in specifics. Strong candidates are current or recent tier-2-and-above SOC analysts, incident responders and forensics investigators, detection engineers, threat hunters, AppSec or product security engineers who fix real vulnerabilities in shipping code, and security engineers who have run or absorbed a red team engagement. Familiarity with an EDR and SIEM stack — CrowdStrike Falcon, Defender and Sentinel, Splunk, SentinelOne, Elastic or equivalent — is treated as a plus rather than a gate. Security leaders are welcome if they are still genuinely near the work; an entirely managerial answer to "walk me through your last investigation" is the most common way this screen goes wrong.

Logistics and confidentiality

  • Remote, US-based, hourly pay for interview time issued as a spot bonus. The $125–175/hr band is what has been observed on this listing, not a guarantee.
  • No prep expected, nothing to build, label or submit after the calls.
  • Sessions are live video, so you need a quiet space and a working camera and mic.
  • You will be asked to describe patterns, not incidents — no named customers, no employer-confidential detail, no unreleased internal tooling specifics. Input is used only for benchmark design and is never attributed to you or your employer. If your employment agreement makes even pattern-level discussion risky, resolve that before the first call.