Full-Time
Sales Manager
Enterprise
Posted on 7/29/2025
GreyNoise
51-200 employees
Baseline traffic data to filter threats
No salary listed
Remote in USA
Remote
All positions are fully remote within the US, with optional office attendance at our DC area headquarters.
 Sales & Account Management (2) |
|---|
| , |
- 5+ years of experience in enterprise cybersecurity sales, preferably SaaS-based
- Solid understanding of enterprise SOC tooling and environments: SIEM, SOAR, EDR, TIP
- Proven track record of meeting or exceeding quota in complex sales environments
- Experience working with enterprise security teams and buying centers
- Fluency in enterprise GTM motions, including MEDDPICC or similar methodologies
- Strong business acumen, curiosity, and problem-solving skills
- Excellent written and verbal communication, with the ability to engage both technical and executive stakeholders
- Existing relationships within select Enterprise accounts
- Own a named list of enterprise accounts and be responsible for meeting or exceeding quarterly quotas
- Build a healthy pipeline and run strategic sales cycles with cross-functional support
- Deliver compelling product presentations and lead Proof of Values (PoVs) with Sales Engineering
- Manage deal progression, close contracts, and coordinate post-sale handoffs
- Maintain CRM hygiene and accurate forecasting in HubSpot
- Identify upsell and expansion opportunities to drive account growth
- Network in customer and related organizations
- Represent GreyNoise at industry events and customer-facing engagements
- Preferably SaaS-based experience in enterprise cybersecurity sales
GreyNoise Intelligence collects and labels data from Internet-wide scans to establish a baseline of normal traffic. It helps organizations ignore benign activity—such as bots, crawlers, and search engines—so security teams can focus on real threats. Access to its data and analytics is provided through a subscription, enabling security analysts and network admins to filter out non-threatening traffic. By offering Anti Threat Intelligence, GreyNoise reduces false positives and helps teams concentrate resources on genuine security risks.
Company Size
51-200
Company Stage
Series A
Total Funding
$20.4M
Headquarters
Washington DC, District of Columbia
Founded
2017
Simplify's Take
What believers are saying
- Edge device exploitation surge with 32-day patch windows drives urgent demand for GreyNoise.
- CrowdStrike and Google SecOps integrations embed GreyNoise data into massive SIEM user bases.
- Project Swarm crowdsources global sensor coverage, expanding detection velocity without capital.
What critics are saying
- CrowdStrike bundles GreyNoise IP classification as free enrichment, eroding standalone subscription value.
- Free IP Checker tool with JSON API cannibalizes enterprise subscriptions via public access.
- Query-Based Blocklists expose full GNQL metadata, enabling competitors to reverse-engineer dynamic feeds.
What makes GreyNoise unique
- Global deception network of 5,000+ sensors across 80 countries observes 500M-1B sessions daily.
- Anti-threat intelligence approach filters noise rather than adding threat indicators.
- Real-time C2 Detection identifies post-exploitation callbacks on edge devices like firewalls.
Help us improve and share your feedback! Did you find this helpful?
Benefits
💵 Equity in a high-growth, Series-A startup
👩⚕️ 100% covered health, dental, vision, and life plans for all employees, as well as 401k with a 6% employer match
🏖 Unlimited paid time off. To encourage time off from work and ensure overall employee health and wellness, GreyNoise requires each employee to take at least 120 hours of PTO (3 weeks) annually, including at least five consecutive business days
🌎 Remote-first culture. While we are headquartered in the Washington DC area, we have a distributed workforce -- with the majority of our team working remotely from across the country
💻 Equipment budget. Every new employee gets $3,000 to spend on equipment, so you can pick whatever works best for you
👼 Paid family leave for all employees. We offer 4 months of paid leave (birth or adoption), plus 2 months of optional unpaid leave, so new parents have time to adjust to the new life (and work) schedule
📚 Learning & development budget. All employees receive an annual $1,500 towards professional development related to their job function. The stipend can be applied to tuition, books, conferences, and more
🌴 Company offsites and monthly local hangouts to encourage team bonding
Growth & Insights and Company News
6 month growth
↑ 0%1 year growth
↑ 1%2 year growth
↓ -1%GreyNoise Intelligence introduces C2 Detection to close the visibility gap at the edge of the network. Apr 7, 2026 Distributed via Leverages outbound telemetry to detect compromises. Washington, DC - April 7, 2026 - GreyNoise Intelligence, the cybersecurity company providing real-time intelligence about network-based attacks, today introduced Command and Control (C2) Detection, a new intelligence module that unlocks valuable insights about cyber attack behavior, based on information contained in outbound network traffic logs. C2 Detection empowers security teams to detect active compromise earlier, prioritize response based on attacker progression, and accelerate investigation by surfacing malware hashes and family classifications tied to confirmed callback infrastructure. "Edge devices have become the most targeted assets on the internet, and the industry's visibility into what happens after they're compromised has been dangerously limited," said Ash Devata, CEO, GreyNoise Intelligence. "GreyNoise has always been one of the most authoritative sources on inbound network threats. With C2 Detection, our customers can not only identify who's probing their perimeter, but whether a device is already compromised and who it's phoning home to." Cyber adversaries frequently attack edge devices to exploit known vulnerabilities and gain access. GreyNoise utilizes the world's most sophisticated deception network of over 5,000 sensors in 80 countries to observe internet traffic, and can determine whether activity is malicious in intent based on certain behavioral characteristics and patterns. In cases where an IP is attempting to initiate a download of malware onto a network, valuable insights can be found in the network's outbound traffic log, since compromised devices often call out to Command and Control (C2) Servers to receive additional instructions. This information can provide valuable insights to help security teams determine whether their perimeter has been breached. Has your device already been compromised? Powered by GreyNoise's callback IP intelligence and malware hash data, C2 Detection provides post-exploitation, outbound-facing threat intelligence by surfacing active compromise through outbound communication with attacker-controlled infrastructure. It provides an end-to-end overview about how attacks actually work, including what payloads were delivered, what binaries were downloaded, which external servers were used for Command and Control, and what commands and behaviors were associated with those sessions. By matching outbound egress traffic against a continuously updated dataset of confirmed malware-hosting IPs and C2 infrastructure, C2 Detection produces a signal that indicates exactly how serious each match is. Security teams can use this dataset of 'phone home' addresses that compromised devices communicate with for potential breach detection via outbound telemetry by matching it against their outbound logs. If an internal device has been communicating with malicious IPs, there is a high degree of likelihood that the device has been compromised. "With C2 Detection, GreyNoise is effectively closing the visibility gap at the edge of the network," said Corey Bodzin, Chief Product Officer, GreyNoise Intelligence. "Up until now, security teams have had a structural blind spot on post-exploitation activity, especially on edge devices like firewalls, VPN concentrators, and internet-facing IoT. These are now the most actively exploited assets on the internet, but Endpoint Detection and Response (EDR) can't be run on them, and their native telemetry is often too sparse to detect callback behavior. Our research shows that millions of edge devices are already infected and silently calling out to malware-hosting servers, C2 nodes, and associated file hashes. C2 Detection surfaces that activity, and empowers security teams to take action faster." About GreyNoise Intelligence GreyNoise empowers the security teams of enterprises and global governments to act with speed and confidence by providing fresh, verifiable threat intelligence about systems at the network edge. This allows security teams to reduce noise in security operations, perform in-depth investigations and threat hunts, and focus on the most critical threats to their networks. Its Global Observation Grid enables GreyNoise Intelligence, Inc. to observe and analyze threat actor campaigns at global scale and share this intelligence with customers in real-time. For more information, please visit https://www.greynoise.io/, and follow GreyNoise Intelligence, Inc. on Twitter, Mastodon and LinkedIn.
GreyNoise appoints Mike Habte as federal sales director. GreyNoise Intelligence has appointed Mike Habte, a federal technology sales and business development executive, as director of federal sales to support the company's growth strategy across defense, intelligence and civilian agencies. The latest leadership appointment at GreyNoise reflects continued momentum across the federal cybersecurity landscape as companies expand capabilities and leadership teams to support government missions. Reserve your seat at the 2026 Cyber Summit on May 21 to connect with peers, stay informed on the latest developments and join insightful discussions on emerging cyber priorities. The company said Monday Habte will lead efforts to expand adoption of its threat intelligence platform among federal systems integrators and agencies that support government cyber missions. Ash Devata, CEO of GreyNoise Intelligence, said the company was established to address a major cybersecurity challenge by helping organizations identify attacks targeting edge systems that often lack sufficient telemetry. "Our platform is already delivering that capability in real-time for our government partners, both domestically and abroad. With Mike Habte leading our federal sales efforts, we're positioned to extend this mission advantage to more agencies and the systems integrators who serve them," added Devata. Who is Mike Habte? Mike Habte is a federal market executive with over 10 years of experience supporting government adoption of cybersecurity and intelligence technologies. Prior to joining GreyNoise, he worked at Recorded Future, where he focused on building partnerships with federal systems integrators and supporting the delivery of intelligence capabilities to government customers. His professional background also includes roles at Babel Street, Palo Alto Networks and DLT Solutions, where he supported federal technology sales and business development efforts, according to his LinkedIn profile. Earlier in his career, he worked at ArchIntel, where he served as global director of research, development and operations. In this capacity, he helped develop and deliver technical intelligence briefings designed to provide leaders at federal systems integrators with situational awareness and competitive insights on the federal technology market. "The federal market is looking for solutions that deliver real efficiency gains - platforms that reduce labor costs, enable AI-driven automation, and serve as force multipliers for cyber programs at the edge," said Habte. "GreyNoise checks every one of those boxes, our signal optimization capabilities are already proven in both government and commercial environments. I'm excited to help more agencies and their integrator partners realize that advantage." What does GreyNoise do? GreyNoise is a cybersecurity company that provides threat intelligence designed to help security teams identify and prioritize internet-wide attack activity targeting network edge systems. The company operates the Global Observation Grid, a deception network made up of thousands of sensors deployed across more than 80 countries that observe and classify attack activity in real time. GreyNoise said its platform helps security operations teams filter out background internet noise, enabling analysts to advance zero trust adoption by focusing on validated threat signals and quickly responding to emerging cyberthreats.
New GreyNoise integrations enhance detection and response capabilities in Google SecOps. The GreyNoise Team March 10, 2026 GreyNoise is launching a new SIEM and SOAR integration - with improved dashboards, detection rules, playbooks, and webhook support Your SIEM ingests everything. Every port scan, every crawl, every opportunistic spray across the internet. The problem isn't the collection - it's context. Which of those IPs are scanning everyone, and which ones are targeting you? That's the question GreyNoise answers. We observe over over 800,000 unique IPs daily across 5,000+ sensors in 80+ countries, classifying each as malicious, suspicious, benign, or unknown, and tagging them with 3,000+ behavioral descriptors. Traditional threat feeds add more indicators to investigate. GreyNoise removes the ones that don't matter. Today, as a Google Integration partner, we're announcing a new and improved integration with Google SecOps that spans both SIEM and SOAR - delivering standardized indicator ingestion, pre-built dashboards, YARA-L detection rules, saved searches, SOAR response actions, webhook support, and ready-to-deploy playbooks. What's new: SIEM. New ingestion script. The GreyNoise ingestion script now lives in Google's official Chronicle ingestion-scripts repository - a standardized process for importing threat intelligence indicators into your environment. Deployed as a Google Cloud Function, it pulls IP reputation data and GNQL query results from the GreyNoise API and ingests them via the Chronicle Ingestion API. The default configuration focuses on malicious IPs observed in the last 24 hours, but teams can customize the GNQL query to match their threat profile. New dashboards. Two interactive dashboards ship with the integration, ready to import into Google SecOps: Indicator Dashboard - 15+ visualization panels covering classification distribution (Malicious, Suspicious, Benign, Unknown), top 10 rankings for organizations, actors, tags, ASNs, categories, operating systems, and source countries, plus CVE distribution, trend analysis, and business service intelligence. Correlation Dashboard - Shows IOC matches between GreyNoise intelligence and events from your environment, with geolocation mapping, event match trends, classification breakdowns, and top IP indicator rankings. New YARA-L detection rules. Three ready-to-deploy rules that start correlating immediately: * IP Match - Detects events where a source or principal IP matches a malicious or suspicious GreyNoise indicator, correlating over a 1-hour window. * Inbound Network Traffic with ASN Context - High-severity rule monitoring firewall logs for permitted inbound connections from GreyNoise-flagged malicious IPs, enriched with ASN attribution. * Brute Force Attack Detection - High-severity rule flagging 5+ blocked login attempts from GreyNoise-flagged IPs within a 15-minute window. New saved searches. Four pre-built UDM queries for investigation workflows: * IP Risk & Vulnerability Details - Classification, anonymization signals, CVEs, and activity timelines * Indicator Context Summary - Actor attribution, geographic details, organizations, and tags * High Risk Indicators - Filters for MALICIOUS or SUSPICIOUS classifications only * All Indicator Lookup - Browse all ingested GreyNoise indicators for ad-hoc investigation What's new: SOAR. Updated Response Actions (v7.0) The GreyNoise SOAR response integration has been updated to version 7.0 with the full suite of actions: | Action | What It Does | | IP Lookup | Full enrichment - classification, tags, metadata | | Quick IP Lookup | Fast context check on any IP | | IP Timeline Lookup | Historical view of scanning behavior over time | | Execute GNQL Query | Run arbitrary GreyNoise queries within a playbook | | Get CVE Details | Vulnerability context from exploitation activity | | Ping | Validate API connectivity | New webhook support. A major addition: webhook support for ingesting GreyNoise alerts and event feeds directly into Google SecOps SOAR. Three webhook types are now available: * Alert Webhook - Ingests IP, CVE, TAG, and GNQL Query alerts * IP Change Webhook - Tracks classification changes in real time * CVE/Tag Webhook - Monitors CVE spikes, status changes, vendor activity, and tag spikes New SOAR playbooks. Pre-built playbooks ship with the integration, providing ready-made automation workflows that teams can deploy or customize. Combined with the webhook connectors and the Generate Alert from GreyNoise GNQL connector, security teams can build end-to-end automated triage pipelines. How it works together. The SIEM and SOAR components work as a unified pipeline: * 1. Ingest - The SIEM integration continuously pulls GreyNoise indicators into Google SecOps with fresh scanner data. * 2. Detect - YARA-L detection rules flag events that correlate with known scanners. Dashboards provide visual context. * 3. Investigate - Saved searches surface IP risk details, actor attribution, and CVE context without writing queries. * 4. Respond - SOAR playbooks enrich flagged IPs automatically. Mass scanners get deprioritized. Targeted activity escalates for review. Webhooks close the loop by pushing GreyNoise alerts - including classification changes and CVE spikes - directly into SOAR for immediate action. Who has access. This integration is available to any joint Google SecOps customer with a GreyNoise API key. No additional licensing required - just configure and go. Like or share: Get the latest blog articles delivered right to your inbox. Be part of the conversation in our Community Slack group. Follow us and don't miss a thing.
GreyNoise IP Checker Helps Users Detect Botnet Activity on Home networks. Cybersecurity firm GreyNoise has launched a free, web-based tool that helps users determine whether their home internet connection participates in malicious activity. The GreyNoise IP Checker answers a question most users never consider: is my router secretly attacking other devices online? Residential IPs are increasingly exploited. Over the past year, residential IP compromise has surged. GreyNoise reports a rise in residential proxy networks that convert home internet connections into exit points for malicious traffic. Attackers achieve this quietly through: * Malware hidden in browser extensions or deceptive apps * Vulnerabilities in home routers or IoT devices The danger lies in the fact that victims rarely notice the activity. Users' devices appear to function normally - streaming continues, browsing works - but in the background, the network may perform vulnerability scans, brute-force attacks, or other malicious operations. GreyNoise explains: "You're not the target - you're the weapon." How the GreyNoise IP Checker works. The GreyNoise IP Checker is available at check.labs.greynoise.io. It does not require registration or collect personal data. The tool analyzes your current IP address against GreyNoise's vast database of internet "background radiation" - the continuous scans and probes that sweep across the web. After scanning, the tool gives one of three results: * Clean - The IP shows no evidence of scanning or malicious activity. Most residential networks fall into this category. * Malicious/Suspicious - The IP shows scanning or brute-force activity. GreyNoise provides a 90-day timeline, revealing when the activity occurred and the type of behavior (e.g., SSH probing or database targeting). * Common Business Service - The IP belongs to a corporate network, VPN, or data center, which may produce background traffic but typically poses no threat. Benefits for everyday users. GreyNoise promotes this tool as ideal for the "Holiday Tech Support" season. Family members who manage home tech can quickly verify if routers, smart TVs, or other IoT devices participate in suspicious activity. In thirty seconds, users receive: * Clear confirmation of network security status * Evidence of compromise to guide firmware updates or security patches * A faster alternative to guessing about viruses or malware Advanced use for IT administrators. Technical users and IT teams can use the programmatic API. By querying the service with curl, administrators can receive structured JSON data, which allows integration into: * MDM (Mobile Device Management) systems * VPN connection scripts * Automated security routines for devices on untrusted networks These features let IT teams monitor and secure endpoints proactively, helping prevent residential or corporate IPs from participating in botnet activity. Making invisible threats visible. Residential IP compromise remains invisible to most users. GreyNoise's new tool changes that by offering enterprise-level threat intelligence to everyday users. By checking IP reputation, users can identify compromised devices and secure home networks against malicious activity. With the increase of IoT devices and smart home technology, tools like the GreyNoise IP Checker become critical for protecting residential networks from hidden cyber threats. More articles & posts. * KawaiiGPT WormGPT Clone KawaiiGPT: A Free WormGPT Clone Leveraging DeepSeek, Gemini, and Kimi-K2... Read More: KawaiiGPT WormGPT Clone * Microsoft Teams Guest Access Security Microsoft Teams Guest Access Exposes Cross-Tenant Security Gap: How Attackers... Read More: Microsoft Teams Guest Access Security * GreyNoise IP Checker GreyNoise IP Checker Helps Users Detect Botnet Activity on Home... Read More: GreyNoise IP Checker * KawaiiGPT WormGPT Clone November 30, 2025 * Microsoft Teams Guest Access Security November 29, 2025 * GreyNoise IP Checker November 29, 2025
GreyNoise IP Check tool launched to detect botnet activity. GreyNoise Labs has launched a new free tool called GreyNoise IP Check that allows users to determine if their IP address has been observed as part of malicious scanning operations, such as those conducted by botnets and residential proxy networks. Identifying Malicious Network Activity The threat monitoring firm, which tracks internet wide activity via a global sensor network, noted that this problem has grown significantly. Many users are unknowingly participating in malicious online activity. GreyNoise explains that over the past year, residential proxy networks have exploded, turning home internet connections into exit points for other people's traffic. While some individuals knowingly install software for this in exchange for money, it is more often caused by malware that sneaks onto devices, usually via nefarious apps or browser extensions, quietly turning them into nodes in someone else's infrastructure. While traditional methods exist to detect botnet activity, such as examining device logs and network traffic, checking the IP address via a simple web tool is the least intrusive method for the average user. Users visiting the scanner's webpage will receive one of three possible results: * Clean: No malicious scanning activity detected. * Malicious/Suspicious: The IP has shown scanning behavior. Users should investigate devices on their network. * Common Business Service: The IP belongs to a VPN, corporate network, or cloud provider, where scanning activity is normal for those environments. When any activity is correlated with the provided IP address, the platform includes a 90 day historical timeline. This helps pinpoint a potential infection point, such as when the installation of a bandwidth sharing client or a shady application precedes malicious scanning, enabling remediation action. For more technical users, GreyNoise also provides an unauthenticated, rate limit free JSON API accessible via curl. This can be easily integrated into custom scripts or automated checking systems.