Senior Application Security Researcher

Role Overview

Join a pioneering organization focused on securing the AI-driven software development lifecycle at all stages, from initial prompt to final production. The Senior Application Security Researcher will play a vital role in advancing modern application security practices by collaborating closely with engineers, security researchers, and AI/data scientists. This position emphasizes innovative build-and-break efforts aimed at next-generation detection, including autonomous and agentic penetration testing capabilities, distinguishing it from conventional AppSec roles.

Key Responsibilities and Expectations

• Drive research and development efforts on cutting-edge security detection methodologies.
• Collaborate with cross-functional teams to integrate security insights into development and operational pipelines.
• Transition security concepts and prototypes into production-ready solutions with minimal supervision.
• Communicate intricate attack vectors and security intricacies clearly to engineering teams and product leadership.

Mandatory Qualifications and Skills

• At least five years of practical experience in offensive security, vulnerability research, or application security roles.
• In-depth knowledge of vulnerabilities affecting web applications and APIs, including complex business-logic errors and chained multi-step attacks.
• Proficiency in programming languages such as Python, Go, or equivalents, with a proven record of deploying production-ready code.
• Experience designing or fine-tuning detection mechanisms including Static/Dynamic Application Security Testing (SAST/DAST), Software Composition Analysis (SCA), secrets scanning, or custom rule engines aimed at minimizing false positives.
• Strong familiarity with contemporary technology stacks such as continuous integration/continuous delivery (CI/CD) pipelines, containerization platforms, Kubernetes orchestration, and at least one leading cloud service provider.
• Practical use of large language models and AI techniques in security contexts, with sound judgment on their benefits and limitations.
• Capability to work confidently with large-scale datasets using SQL, BigQuery, or similar tools to support security research and validate detection accuracy.
• Master’s degree in Computer Science, Cyber Security, or related disciplines.
• Excellent written communication skills to effectively articulate complex security scenarios to diverse stakeholders.

Desirable Attributes

• Publications, CVE contributions, presentations at security conferences, or recognized achievements in bug bounty programs.
• Hands-on experience developing AI agents or frameworks for evaluating large language models.
• Background expertise in exploit creation, red teaming activities, or penetration testing engagements.
• Knowledge of code analysis methodologies such as taint tracking, call graph analysis, and reachability studies.
• Participation in open-source security tooling projects.