Senior Application Security Researcher

This is a fully remote position, open to applicants in Spain.

📋 Description

• Advance modern application security through active security research.

• Collaborate with engineers, researchers, and AI/data scientists on next-generation detection technologies.

• Create autonomous, agent-based penetration testing capabilities.

• Construct and dismantle security solutions, moving beyond a conventional AppSec role.

• Transform research concepts from prototype stage to production implementation.

⛳️ Requirements

• Over 5 years of hands-on experience in offensive security, vulnerability research, or application security.

• Profound understanding of web application and API vulnerabilities, encompassing business-logic flaws and multi-step attack chains.

• Proficient coding skills in Python, Go, or similar languages, with experience delivering production-quality code.

• Background in developing or refining detection logic (SAST, DAST, SCA, secrets, or custom rule engines) while minimizing false positives.

• Strong knowledge of modern technology stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud service provider.

• Practical experience utilizing LLMs / AI models for security tasks, with the ability to assess their effectiveness and limitations.

• Comfortable working with large datasets (SQL, BigQuery, or similar) to enhance research and evaluate detection accuracy.

• Capable of taking research concepts from prototype to production with little oversight.

• Excellent written communication skills — able to articulate complex attack paths to engineers and product managers.

• Master’s degree in Computer Science, Cyber Security, or a related field.

• Nice to have: Published research, CVEs, conference presentations, or a history of successful bug bounties.

• Nice to have: Experience in developing AI agents or evaluation frameworks for LLMs.

• Nice to have: Background in exploit development, red teaming, or penetration testing.

• Nice to have: Familiarity with code analysis techniques (taint analysis, call graphs, reachability).

• Nice to have: Contributions to open-source security tools.

🏝️ Benefits

• Opportunity for remote work.

• Full-time employment position.