Senior Application Security Researcher

Job summary

The researcher will work with engineers and data scientists to develop next-generation detection capabilities, including autonomous agentic pen-testing. This role involves taking research ideas from prototype to production to secure AI-driven SDLC processes.

Job details

The company secures the AI-driven SDLC from prompt to production, unifying development and cloud context to stop vulnerabilities at the source. The Security Research group is hiring a senior, hands-on Application Security Researcher to push modern AppSec forward — working with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is a build-and-break role, not a typical AppSec position. Requirements Must-have skills: 5+ years hands-on in offensive security, vulnerability research, or application security Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains Strong coding in Python, Go, or similar, with production-quality code shipped Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy Takes research ideas from prototype to production with minimal guidance Clear written communication — can explain a complex attack path to engineers and product managers M.Sc. in Computer Science, Cyber Security, or a related field Nice to have: Published research, CVEs, conference talks, or a bug bounty track record Experience building AI agents or evaluation frameworks for LLMs Background in exploit development, red teaming, or penetration testing Code analysis techniques (taint analysis, call graphs, reachability) Contributions to open-source security tools

What you’ll do

The researcher will work with engineers and data scientists to develop next-generation detection capabilities, including autonomous agentic pen-testing. This role involves taking research ideas from prototype to production to secure AI-driven SDLC processes.

Requirements

Candidates must have at least 5 years of experience in offensive security or vulnerability research and strong coding skills in Python or Go. A Master's degree in Computer Science or a related field is required, along with deep knowledge of web application vulnerabilities and modern cloud stacks.

Listed skills

• Kubernetes · Preferred
• SQL · Preferred
• CI/CD · Preferred
• Go · Preferred
• Python · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Offensive security
• Vulnerability research
• Application security
• Python
• Go
• SAST
• DAST
• SCA
• CI/CD
• Kubernetes
• Cloud computing
• LLMs
• AI models
• SQL
• BigQuery
• Exploit development
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Security Tools
• Red Teaming
• Exploit Development
• Code Analysis
• Go (Programming Language)
• AI Agents
• Research
• Application Programming Interface (API)
• Artificial Intelligence
• Business Logic
• Penetration Testing
• Application Security
• Google BigQuery
• Computer Science
• Cyber Security
• Python (Programming Language)
• Offensive Security
• Systems Development Life Cycle
• SQL (Programming Language)
• Vulnerability Management
• Writing

Job areas

• Technology
• Security & Safety
• Software
• Data & Analytics
• Science & Research
• Security Researcher
• Vulnerability Analyst / Penetration Tester
• Database and Network Professionals Not Elsewhere Classified
• Penetration Testers
• Computer Occupations, All Other

More jobs from Commit