Security Researcher

This is a fully remote position, open to applicants in Serbia.

📋 Description

• Conduct research on browser, WebView, Android, and iOS environments from the perspective of potential attackers.

• Discover new security signals, behavioral indicators, and technical patterns to enhance detection of fraud, abuse, automation, and AI agents.

• Analyze attacker methodologies that involve bots, browser automation, AI agents, emulators, device spoofing, hooking, instrumentation, remote access tools, and anti-detection techniques.

• Create and execute experiments that compare legitimate, automated, AI-assisted, and manipulated environments.

• Assess proposed signals for reliability, stability, susceptibility to spoofing, privacy concerns, performance implications, and feasibility for production.

• Convert research outcomes into precise SDK feature specifications for web and mobile data collection.

• Develop internal tools, scripts, and lab settings for signal research and validation.

• Work in collaboration with SDK, engineering, product, and detection teams to transition research from theory to practical application.

⛳️ Requirements

• Over 3 years of practical experience in security research, mobile security, browser research, fraud detection, reverse engineering, or a similar technical role.

• Proficiency with web browsers, mobile browsers, WebViews, browser APIs, JavaScript runtime behavior, browser automation, fingerprinting, client-side web security, and low-level browser technologies.

• Knowledge of contemporary open-source browser architectures or codebases, including Chromium, WebKit, Blink, or Gecko.

• Familiarity with native Android and/or iOS applications, mobile operating system behavior, application instrumentation, emulators, device spoofing, mobile automation, mobile security, and low-level platform APIs.

• An attacker mindset with a solid understanding of bypass techniques involving automation, AI agents, spoofing, and anti-detection strategies.

• Capability to recognize subtle technical signals and convert them into practical detection or data collection methods.

• Experience in designing technical experiments and validating research hypotheses.

• Proficiency in one or more SDK development languages and environments: TypeScript/JavaScript, Kotlin/Java, or Swift/Objective-C.

• Scripting skills, preferably in Python.

• Ability to independently tackle ambiguous challenges and effectively communicate findings to engineering, product, and research stakeholders.

• Advantageous to have experience with Web SDKs, Mobile SDKs, client-side telemetry, device intelligence, behavioral signals, AI agent detection, or fraud detection products.

• Advantageous to have researched bots, credential stuffing, scraping, headless browsers, AI-assisted automation, application cloning, SDK abuse, phishing kits, malware, or anti-detection frameworks.

• Experience in reverse engineering Android or iOS applications is a plus.

• Familiarity with detection quality measurement, feature evaluation, false-positive analysis, production monitoring, or machine learning concepts is a plus.

• A Bachelor's degree in Computer Science, Cybersecurity, Data Science, or a related field—or equivalent hands-on experience is beneficial.

🏝️ Benefits

• Security ensured through thorough client vetting to reduce risks and guarantee reliability and timely payments.

• Career support and assistance in locating new project opportunities.

• Legal guidance for independent contractors or sole proprietorship status, taxes, and associated processes.

• English language courses.

• Opportunities for professional development.

• Team-building activities.

• People-first management approach with minimal bureaucracy.

• A friendly company culture.

• Flexible working hours.

• Comprehensive financial and legal support for independent contractors.

• Free English classes with native speakers or Ukrainian instructors.

• Dedicated HR support.