In the past month I’ve had three interviews where the JD promised ‘emerging threats research’ — LLM prompt-injection tracking, eBPF telemetry, and quick YARA/Sigma protos — but the hiring managers admitted the work is 80% backlog triage. If you’re in a role that protects time for original research and security innovation, which teams are doing it and how is the split structured?
Only teams I’ve seen keep real research time have a separate triage pod and a written 60/40 split, plus a no-oncall “research week” every third sprint tied to YARA/Sigma protos and LLM prompt-injection writeups. When a manager says “80% backlog triage,” I ask to see last quarter’s research artifacts and get the split in the offer; if they can’t show it, it won’t happen. If you want examples to model, look at TAG/MSTIC cadence, with the caveat you trade product tickets for publishable work.
Ran into this at a cloud vendor: we carved a 60/30/10 (research/eng/triage) with a no-oncall “research week” every third sprint like @nwood49, but it only stuck after we put triage in a separate queue with a 24h SLA and locked Jira so PMs couldn’t yank us. In interviews, ask for a 6-week pilot with written deliverables (e.g., two YARA/Sigma protos and an LLM prompt‑injection corpus) and name who owns eBPF telemetry; if they won’t commit, assume it’s 80% backlog.