Staff Security Researcher

Accountabilities:: Create and maintain detection rules, primarily using OpenGrep, to identify novel malware and vulnerability patterns and improve detection accuracy. Extend security analysis capabilities to support additional programming languages across the analysis pipeline. Research emerging vulnerabilities, exploitation techniques, cloud-native attack paths, and AI-specific threats, translating findings into production-ready detections. Investigate modern web applications and APIs, develop proof-of-concept attacks, and convert research findings into deployable security capabilities. Develop attack-chain templates that connect lower-severity findings into meaningful exploitation paths. Design and maintain evaluation harnesses, testing frameworks, and benchmarks to measure coverage, accuracy, exploit reproducibility, and false-positive rates. Triage complex findings and packages from the analysis pipeline and validate detection results. Apply established detection and exploitation principles while contributing to new research standards, policies, and attack methodologies. Explore emerging tools and techniques for detecting threats and malware at scale. Research security topics across AppSec, AI red-teaming, offensive AI, LLM vulnerabilities, agent security, MCP security, and cloud-native attack techniques. Contribute to internal research initiatives and help shape future security research priorities. Publish technical research through blog posts, CVEs, advisories, tool releases, and conference contributions where appropriate. Mentor junior and mid-level security researchers on detection writing and exploitation techniques. Collaborate with engineering, product, AI/ML, infrastructure, platform, and security teams to ensure research outputs are successfully deployed and maintained. Help improve security automation across CI/CD and cloud-native environments while maintaining high detection quality. Requirements: 8+ years of experience in offensive security or application security research, or equivalent experience supported by a relevant Bachelor's or Master's degree. Broad programming knowledge, with strong JavaScript skills required and Python experience highly valued. Deep understanding of security principles, standards, best practices, vulnerability classifications, exploitation methodologies, and secure software development. Extensive experience writing detection logic for DAST scanners, fuzzers, or comparable security systems, including response interpretation and false-positive management. Experience designing testing frameworks, evaluation harnesses, or large-scale validation systems for security tooling. Strong web application penetration-testing experience covering the OWASP Top 10, authentication, authorization, business logic, REST, GraphQL, and modern API surfaces. Ability to tackle complex technical and algorithmic problems, including parsing and AST-based analysis. Strong hands-on experience with offensive security tools such as Burp Suite, sqlmap, nmap, ffuf, and custom payload-generation techniques. Solid understanding of HTTP and web protocol fundamentals. Experience with cloud platforms, Kubernetes, containers, infrastructure-as-code, and CI/CD security is highly desirable. Practical experience researching or securing LLM-powered applications, AI agents, or AI-assisted development workflows, including prompt injection, model abuse, tool invocation risks, MCP security, and emerging AI attack techniques. Fluent English with strong written and verbal communication skills and the ability to explain complex technical topics to both technical and non-technical audiences. Strong collaboration skills and sound judgment when determining when issues require escalation. Hands-on mindset, intellectual curiosity, and willingness to research across traditional application security, cloud-native security, and rapidly evolving AI security domains. Experience with OpenGrep or Semgrep, static analysis, production-ready security systems, YARA, or public security research such as CVEs, advisories, talks, or open-source tools is a plus. Benefits: Fully remote work from Europe, with the role open to candidates working within CET ±2 hours. Health, pension, and statutory benefits tailored to your country of residence. 24/7 Employee Assistance Program offering emotional support, life coaching, dependent and elder care, financial and legal support, wellness coaching, and new-parent support. Quarterly wellness days providing an additional day off each quarter for rest and rejuvenation. 5 paid volunteer days per year to support charitable or community activities of your choice. Paid birthday day off. Employee recognition and rewards programs. A culture focused on personal and professional development. Flexible, remote working environment designed to support work-life balance. Competitive compensation and a broader total-rewards approach adapted to regional needs. Opportunities to contribute to meaningful security research and develop expertise across application security, cloud, and AI security.