Senior Security Research Engineer – SecureChain

This is a fully remote position, open to applicants in Poland, +5 more countries.

📋 Description

• Take ownership of SecureChain's malicious-code detection system, including the review and classification of alerts, creation of a test corpus, establishment of quality benchmarks, and management of false-positive and coverage metrics.

• Enhance detection capabilities through artifact scanning, static signals, dynamic analysis, and integration of external intelligence.

• Develop repeatable processes to identify high and critical vulnerabilities in supported open-source software, including versions that are no longer supported.

• Reproduce findings to validate their impact and reachability, while maintaining consistent evidence for future reference.

• Create AI-assisted approaches to generate and test potential fixes for automation of patches.

• Manage TuxCare CNA responsibilities, including CVE assignment, ensuring record quality, and coordinating disclosures with upstream projects.

• Collaborate with the Marketing team to prepare technical documentation and research publications.

• Assume responsibilities for detector operations, sample review, and CNA tasks within the initial 30 days.

• Optimize detector workflows and initiate a vulnerability discovery pilot during the period of days 31 to 60.

• Broaden discovery efforts, complete coordinated disclosures where relevant, and publish the first research output during days 61 to 90.

⛳️ Requirements

• Background in security research focusing on malware or software supply-chain research, vulnerability discovery, and root-cause analysis.

• Proficiency in Python or another relevant systems programming language.

• Experience in developing production tools and building pipelines.

• Familiarity with CI pipelines, test automation, and managing operating services.

• Practical knowledge of static analysis, fuzzing, and sandboxing techniques.

• Regular, daily utilization of AI-assisted tools in both research and engineering processes.

• Experience across multiple package ecosystems, including but not limited to PyPI, npm, Maven, Go, or various Linux distributions.

• Ability to produce clear research reports and experience in coordinated disclosure practices.

• Proficient in written and spoken English at an advanced level.

• Previous publication of CVEs, advisories, or security research is desirable.

• Experience with CNA operations or familiarity with vulnerability databases like CVE or OSV is a plus.

🏝️ Benefits

• Emphasis on professional development.

• Engaging and challenging projects.

• Fully remote work with flexible hours, enabling you to manage your schedule and work from any location worldwide.

• Paid 24 days of vacation annually.

• 10 national holidays.

• Unlimited sick leave.

• Coverage for private medical insurance.

• Reimbursement for co-working expenses.

• Support for gym or sports-related costs.

• Budget allocated for educational pursuits.

• Opportunity to earn a reward for the most innovative idea that the company might patent.