Application Security Researcher

What You'll Bring

• M.Sc. in Computer Science, Cyber Security, or a related field
• 5+ years of hands-on experience in offensive security, vulnerability research, or application security
• Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains
• Strong coding skills in Python, Go, or a similar language, with experience shipping production-quality code
• Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives
• Solid grasp of modern application and infrastructure stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider
• Hands-on experience using LLMs or AI models for security tasks, and the judgment to measure where they help and where they fail
• Comfort working with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy
• Ability to take a research idea from prototype to production with minimal guidance
• Clear written communication: you can explain a complex attack path to engineers and product managers
• Published research, CVEs, conference talks, or bug bounty track record
• Experience building AI agents or evaluation frameworks for LLMs
• Background in exploit development, red teaming, or penetration testing
• Experience with code analysis techniques (taint analysis, call graphs, reachability)
• Contributions to open-source security tools