What the work involves

This is a research engagement, not a labeling project. Over roughly four weeks you'll sit for two or three one-hour video calls with Mercor's benchmark team, scheduled around your calendar. The conversations are structured but conversational: what lands in your queue and how you decide what to touch first, which tools you actually live in versus the ones on the architecture diagram, how your team judges whether a triage was correct or a detection rule was well-built, and where AI assistance currently helps versus where it produces plausible-sounding noise you have to unwind.

One session will likely walk through a draft task taxonomy — a breakdown of enterprise defense work into evaluable units. They want you to argue with it: what's missing, what's mislabeled as one task when it's really three, what's weighted as hard that's actually rote, and what a benchmark would have to get right before you'd believe its scores.

What the screen looks for

  • Hands-on recency. Tier 2+ SOC analysts, incident responders and DFIR investigators, detection engineers, threat hunters, AppSec/product security engineers who ship fixes into production code, and security engineers with red team exposure on either side. Leaders are welcome if they're still close to the console.
  • Tool specificity. Naming CrowdStrike Falcon, Defender/Sentinel, Splunk, SentinelOne, or Elastic is a plus — but the screen is checking whether you can describe what querying or tuning in those tools is actually like, not that you recognize the vendor names.
  • Quality judgment. The single most valuable thing you bring is how your team distinguishes good work from adequate work — a well-scoped containment from an over-broad one, a durable detection from one that dies on the next environment change.
  • Confidentiality discipline. You'll be asked for patterns, never specific incidents, and to leave out anything proprietary to current or former employers or customers.

Logistics

Remote and US-based. Sessions are live video, one hour each, with no prep expected and nothing to submit between calls. Pay is hourly for interview time, issued as a spot bonus; observed rates for this listing sit in the $125–175/hr range, which is stated as observed rather than guaranteed. Total commitment is two to three hours spread over about a month.