Security Researcher

Role overview Research vulnerabilities in open-source and customer code, assess findings from an AI-assisted scanner, and use that research to improve future detection. The work combines manual source-code auditing with vulnerability triage and collaboration on the rules and strategies used by the scanning engine.

Responsibilities - Investigate software projects and customer codebases for security vulnerabilities across multiple languages. - Validate and prioritize scanner findings, helping distinguish genuine issues from false positives. - Write clear vulnerability reports and coordinate responsible disclosure and CVE assignment. - Refine detection rules, heuristics, and prompt strategies based on research results. - Work with engineers to improve detection of authorization and business-logic flaws. - Contribute research write-ups for public-facing security publications.

Requirements - At least three years of experience in application security research, penetration testing, or red teaming. - Demonstrated success finding and responsibly disclosing vulnerabilities through CVEs, bug bounties, or published research. - Strong knowledge of common vulnerability classes, including OWASP risks, authorization bypasses, injection, and business-logic flaws. - Ability to analyze source code in languages such as Python, JavaScript or TypeScript, Go, Java, or C/C++. - Experience with static analysis concepts, code review, and source-code auditing. - Strong written communication for technical reports and research findings.

Nice to have - Published CVEs or a substantial bug-bounty record. - Familiarity with code-analysis tools such as tree-sitter, Semgrep, or CodeQL. - Experience with AI-assisted security research or contributions to open-source security projects.

Benefits and work setup - Full-time role, remote within the United States. - Compensation of $140,000–$180,000 plus equity.