Offensive Security Researcher, Senior

Description

The company builds an AI CRM where people and AI agents work together on customer success, and it is moving its workforce toward agent-based work.

The team is hiring a senior offensive security researcher who thinks like an attacker to find, analyze, and help fix security weaknesses across the company's products and platforms.

The focus is on root causes, structural weaknesses, and repeated security mistakes, with the aim of building defaults that stop vulnerabilities before they happen.

You will work with engineering teams and shape their design choices, raising the overall maturity of application security.

Candidates should apply for no more than 3 roles within 12 months to avoid duplicate effort.

Benefits and resources are offered to help you keep a healthy work-life balance.

Responsibilities

• Run offensive security assessments that combine manual testing, code review, architecture analysis, and threat modeling across application environments.
• Find critical, high-impact, and systemic vulnerabilities as well as isolated issues.
• Research new attack methods, abuse scenarios, and bypass techniques that affect the company's applications and platforms.
• Work closely with software engineers, tech leads, and architects to explain risk, impact, and how easily a flaw can be exploited, then design and build fixes that scale, are maintainable, and suit engineering constraints.
• Lead secure-by-default work by adding guardrails, patterns, and baseline controls, fixing unsafe defaults and configurations, and preventing flaws through platform and framework updates.
• Shape application and platform designs early in the development lifecycle so vulnerabilities are prevented before release.
• Set security standards, best practices, and architecture guidance used during application development.
• Coach engineers and peers by sharing security knowledge and offensive techniques.
• Work with detection, monitoring, and incident response teams to improve visibility into real exploitation.

Requirements

• 7+ years of experience in application security or offensive security, with an attacker mindset.
• A track record of independently finding and fixing vulnerabilities in complex applications.
• Solid understanding of web application security (including the OWASP Top 10 and beyond), authentication and authorization flaws, API security, injection attacks, logic flaws, access control bypasses, and secure design with threat modeling.
• Hands-on experience with manual security testing, not only automated tools.
• The ability to turn complex findings into clear, practical guidance for engineers and technical leaders.
• Strong communication and collaboration skills, with a record of influencing engineering teams.
• Even better if: you have published security research or CVEs, such as blogs, advisories, whitepapers, or conference talks.
• Even better if: you have built platform-level or framework-level security improvements.
• Even better if: you have a background in vulnerability discovery, security research, or red teaming.
• Even better if: you have implemented secure-by-default or security-by-design concepts.
• Even better if: you are familiar with cloud-native architectures, microservices, and distributed systems.
• Even better if: you can balance security needs with product velocity and developer experience.

Benefits

• Benefits and resources that support balance and personal growth.