Staff Security Researcher

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Security Researcher based in Spain. This role is designed for a hands-on offensive security researcher who can turn advanced vulnerability and malware research into production-ready detection capabilities. You will investigate emerging threats across web applications, APIs, cloud-native environments, and AI-powered systems, translating discoveries into accurate security checks with low false-positive rates. The position combines deep technical research with practical engineering, from exploit proof-of-concepts to detection rules, evaluation frameworks, and attack-chain methodologies. You will also contribute to research standards, security tooling, and the broader application security community through publications and technical contributions. Working across engineering, product, AI/ML, and infrastructure teams, you will help ensure research moves efficiently from discovery to production. The role offers a high degree of ownership in a fast-evolving security environment where technical curiosity and measurable detection quality are highly valued.

Create and maintain detection rules, primarily using OpenGrep, to identify novel malware and vulnerability patterns and improve detection accuracy. Extend security analysis capabilities to support additional programming languages across the analysis pipeline. Research emerging vulnerabilities, exploitation techniques, cloud-native attack paths, and AI-specific threats, translating findings into production-ready detections. Investigate modern web applications and APIs, develop proof-of-concept attacks, and convert research findings into deployable security capabilities. Develop attack-chain templates that connect lower-severity findings into meaningful exploitation paths. Design and maintain evaluation harnesses, testing frameworks, and benchmarks to measure coverage, accuracy, exploit reproducibility, and false-positive rates. Triage complex findings and packages from the analysis pipeline and validate detection results. Apply established detection and exploitation principles while contributing to new research standards, policies, and attack methodologies. Explore emerging tools and techniques for detecting threats and malware at scale. Research security topics across AppSec, AI red-teaming, offensive AI, LLM vulnerabilities, agent security, MCP security, and cloud-native attack techniques. Contribute to internal research initiatives and help shape future security research priorities. Publish technical research through blog posts, CVEs, advisories, tool releases, and conference contributions where appropriate. Mentor junior and mid-level security researchers on detection writing and exploitation techniques. Collaborate with engineering, product, AI/ML, infrastructure, platform, and security teams to ensure research outputs are successfully deployed and maintained. Help improve security automation across CI/CD and cloud-native environments while maintaining high detection quality. Requirements: 8+ years of experience in offensive security or application security research, or equivalent experience supported by a relevant Bachelor's or Master's degree. Broad programming knowledge, with strong JavaScript skills required and Python experience highly valued. Deep understanding of security principles, standards, best practices, vulnerability classifications, exploitation methodologies, and secure software development. Extensive experience writing detection logic for DAST scanners, fuzzers, or comparable security systems, including response interpretation and false-positive management. Experience designing testing frameworks, evaluation harnesses, or large-scale validation systems for security tooling. Strong web application penetration-testing experience covering the OWASP Top 10, authentication, authorization, business logic, REST, GraphQL, and modern API surfaces. Ability to tackle complex technical and algorithmic problems, including parsing and AST-based analysis. Strong hands-on experience with offensive security tools such as Burp Suite, sqlmap, nmap, ffuf, and custom payload-generation techniques. Solid understanding of HTTP and web protocol fundamentals. Experience with cloud platforms, Kubernetes, containers, infrastructure-as-code, and CI/CD security is highly desirable. Practical experience researching or securing LLM-powered applications, AI agents, or AI-assisted development workflows, including prompt injection, model abuse, tool invocation risks, MCP security, and emerging AI attack techniques. Fluent English with strong written and verbal communication skills and the ability to explain complex technical topics to both technical and non-technical audiences. Strong collaboration skills and sound judgment when determining when issues require escalation. Hands-on mindset, intellectual curiosity, and willingness to research across traditional application security, cloud-native security, and rapidly evolving AI security domains. Experience with OpenGrep or Semgrep, static analysis, production-ready security systems, YARA, or public security research such as CVEs, advisories, talks, or open-source tools is a plus. Benefits: Fully remote work from Europe, with the role open to candidates working within CET ±2 hours. Health, pension, and statutory benefits tailored to your country of residence. 24/7 Employee Assistance Program offering emotional support, life coaching, dependent and elder care, financial and legal support, wellness coaching, and new-parent support. Quarterly wellness days providing an additional day off each quarter for rest and rejuvenation. 5 paid volunteer days per year to support charitable or community activities of your choice. Paid birthday day off. Employee recognition and rewards programs. A culture focused on personal and professional development. Flexible, remote working environment designed to support work-life balance. Competitive compensation and a broader total-rewards approach adapted to regional needs. Opportunities to contribute to meaningful security research and develop expertise across application security, cloud, and AI security.

laptop-ats-crawler v3