Senior Application Security Researcher

This is a fully remote position, open to applicants in Ukraine.

📋 Description

• Conduct research to enhance contemporary application security detection capabilities.

• Collaborate with engineers, researchers, and AI/data scientists on developing next-generation detection methods.

• Create autonomous, agentic penetration-testing functionalities.

• Engage in a hands-on research role to build and dismantle security solutions.

• Transition research concepts from prototype to production.

⛳️ Requirements

• Over 5 years of practical experience in offensive security, vulnerability research, or application security.

• Comprehensive knowledge of web application and API vulnerabilities, including business-logic flaws and multi-step attack sequences.

• Proficient coding skills in Python, Go, or similar languages, with a proven record of shipping production-quality code.

• Experience in constructing or fine-tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) to minimize false positives.

• Strong understanding of modern technology stacks: CI/CD pipelines, containers, Kubernetes, and familiarity with at least one major cloud provider.

• Hands-on experience with LLMs / AI models for security applications, accompanied by the acumen to assess their effectiveness and limitations.

• Comfortable working with large datasets (SQL, BigQuery, or equivalent) to support research and evaluate detection precision.

• Ability to take research ideas from prototype to production with little oversight.

• Excellent written communication skills — capable of articulating complex attack pathways to engineers and product managers.

• M.Sc. in Computer Science, Cyber Security, or a related discipline.

• Evidence of published research, CVEs, conference presentations, or a successful bug bounty history.

• Experience in developing AI agents or evaluation frameworks for LLMs.

• Background in exploit development, red teaming, or penetration testing.

• Familiar with code analysis techniques (taint analysis, call graphs, reachability).

• Contributions to open-source security tools.

🏝️ Benefits

• Remote work arrangement.