Threat Research Engineer, Security

This is a fully remote position, open to applicants in Poland, +1 more country.

📋 Description

• Investigate new attack surfaces and threat vectors, encompassing AI coding agents, agent plugins, and package ecosystems.

• Identify and responsibly disclose vulnerabilities within open source projects and developer tools.

• Examine software supply chain incidents and events.

• Develop AI-driven workflows and agents that automate research, analysis, and detection processes.

• Construct and maintain cloud-based systems that support detection and advisory functions.

• Enhance the quality and coverage of vulnerability and malware advisories.

• Document findings as blog posts and present them at industry conferences.

• Engage in on-call or operational support as necessary.

• Transform initial concepts into functional proofs of concept, deploy them, and evaluate the outcomes.

⛳️ Requirements

• Practical security experience in research, malware analysis, penetration testing, or security tooling, possessing both a developer mindset and an adversarial approach.

• Proven experience utilizing AI in practical applications, such as working with large language model APIs or agent frameworks like LangChain, LangGraph, or agent SDKs.

• Proficient programming capabilities in Go or Python.

• Adherence to good software engineering practices, including testing, code reviews, continuous integration and delivery, and writing maintainable code.

• Experience in deploying and managing production services on a public cloud platform.

• Knowledge of package ecosystems and software supply chain attack methodologies.

• Capability to identify potential attack vectors, articulate trade-offs, and make decisions based on data.

• Proficient writing skills that effectively communicate findings to both technical and general audiences.

• Preferred but not mandatory: documented vulnerability findings; security research related to AI agents, large language model applications, or Model Context Protocol (MCP) servers; experience with Google Cloud Platform; or familiarity with infrastructure as code using Terraform or OpenTofu.

• A foundational understanding of compilers or static application security testing engines is adequate.

🏝️ Benefits

• Comprehensive benefits to support your health, finances, and overall well-being.

• Flexible Paid Time Off policy.

• Access to Team Member Resource Groups.

• Equity Compensation & Employee Stock Purchase Plan.

• Growth and Development Fund.

• Parental Leave.