TuxCare

Senior Security Research Engineer (SecureChain)

Brak informacji o wynagrodzeniu

SeniorZdalnie·WarszawaFull-time

#467134·Dodano 8 dni temu·1

Źródło: TuxCare

Aplikuj teraz

Tech Stack / Keywords

PythonCIstatic analysisfuzzingsandboxingPyPInpm Maven Go Linux

Podsumowanie oferty

You will establish SecureChain’s Security Research & Automation function for an open-source software supply chain security product. You will scale security research by building production-quality tools and pipelines to detect malicious code, discover vulnerabilities, and develop AI-assisted candidate fixes.

Wymagania

Must-haves:

Background in security research, including malware or software supply-chain research, vulnerability discovery, and root-cause analysis.
Strong Python or another suitable systems language, with experience building production tools and pipelines.
Experience with CI pipelines, test automation, and operating services.
Practical use of static analysis, fuzzing, and sandboxing.
Heavy, daily use of AI-assisted tools in research and engineering.
Experience with more than one package ecosystem, such as PyPI, npm, Maven, Go, or Linux distributions.
Ability to write clear research reports and experience with coordinated disclosure.
Advanced written and spoken English.

Nice to have:

Published CVEs, advisories, or security research.
Experience with CNA operations or vulnerability databases such as CVE and OSV.

Obowiązki

Own SecureChain’s malicious-code detector, including alert review and classification, test corpus, quality benchmarks, false-positive metrics, and coverage metrics.
Extend detection with artifact scanning, static signals, dynamic analysis, and external intelligence.
Build repeatable pipelines to discover vulnerabilities in software supported by SecureChain and ELS, prioritizing high and critical risks and end-of-life versions customers still use.
Reproduce findings, prove impact and reachability, and store evidence so another researcher can repeat the result.
Develop AI-assisted methods to generate and test candidate fixes, and feed them into patch automation.
Own TuxCare CNA work: CVE assignment, record quality, and coordinated disclosure with upstream projects.
Prepare technical write-ups and research publications with Marketing.

Your first 90 days:

Days 1–30: Take over the malicious-code detector, sample review, and CNA responsibilities; inventory services, data, prompts, corpus, and open work.
Days 31–60: Improve the detector and its review workflow, measure alert volume, false positives, and cost, and start a vulnerability-discovery pilot on 5–10 packages in one ecosystem.
Days 61–90: Expand discovery across the ecosystem, complete coordinated disclosure where applicable, and publish the first research output.

Benefity

Focus on professional development.
Fully remote work with flexible working hours.
Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leave.
Compensation for private medical insurance.
Co-working and gym/sports reimbursement.
Budget for education.
Opportunity to receive a reward for the most innovative idea the company can patent.

Elastyczne godziny

Płatne święta

Opieka zdrowotna

Dofinansowanie szkoleń

TuxCare

4 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz