Security Researcher

Role overview Research vulnerabilities in open-source software and customer codebases, then use those findings to improve an AI-assisted code scanning system. The role combines manual application security research with validation of machine-generated results, responsible disclosure, and collaboration with engineers to strengthen detection of difficult vulnerability classes.

Responsibilities - Audit codebases across multiple languages to find security vulnerabilities. - Review and triage scanner findings, assessing their validity and helping calibrate false-positive rates. - Prepare clear vulnerability reports and coordinate responsible disclosure and CVE assignment. - Refine detection rules, heuristics, and prompts based on research findings. - Work with engineers to improve detection of business logic and authentication flaws. - Contribute research write-ups for public security channels.

Requirements - At least three years of experience in application security research, penetration testing, or red teaming. - Evidence of finding and responsibly disclosing vulnerabilities through CVEs, bug bounties, or published research. - Understanding of common vulnerability classes, including OWASP Top 10 issues, business logic flaws, authentication bypasses, and injection chains. - Ability to read and analyze code in one or more of Python, JavaScript/TypeScript, Go, Java, or C/C++. - Experience with static analysis concepts, code review, and source auditing. - Strong written communication for technical reports and research publications.

Nice to have - Published CVEs or a substantial bug bounty record. - Experience with code analysis tools such as tree-sitter, Semgrep, or CodeQL. - Familiarity with LLM-based security tools or AI-assisted research, or contributions to open-source security projects.

Benefits and work setup - Full-time, remote role within the United States, in a security-focused team. - Listed compensation: $140,000–$180,000 plus equity.