Senior Application Security Researcher

About the role

The company secures the AI-driven SDLC from prompt to production, unifying development and cloud context to stop vulnerabilities at the source. Its Security Research group is hiring a senior, hands-on Application Security Researcher to work with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is described as a build-and-break role, not a typical AppSec position.

Required profile

• 5+ years of hands-on experience in offensive security, vulnerability research or application security
• M.Sc. in Computer Science, Cyber Security or a related field
• Ability to take research ideas from prototype to production with minimal guidance
• Clear written communication, able to explain complex attack paths to engineers and product managers

Nice to have

• Published research, CVEs, conference talks or a bug bounty track record
• Experience building AI agents or evaluation frameworks for LLMs
• Background in exploit development, red teaming or penetration testing
• Open-source security tool contributions

Required skills

• Web application and API vulnerabilities, including business-logic flaws and multi-step attack chains
• Python, Go or similar, with production-quality code shipped
• SAST, DAST, SCA, secrets scanning or custom rule engines, with experience tuning detection logic and reducing false positives
• CI/CD pipelines, containers, Kubernetes and at least one major cloud provider
• LLMs and AI models for security tasks, with judgment on their limits
• Large datasets (SQL, BigQuery or similar) to measure detection accuracy