What you'll be doing

• Research new attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems.
• Find and responsibly disclose vulnerabilities in open source projects and developer tools.
• Analyze software supply chain incidents and events.
• Build AI-powered workflows and agents that automate research, analysis, and detection.
• Build and maintain the cloud-based systems behind detection and advisory work.
• Improve the quality and coverage of vulnerability and malware advisories.
• Write blog posts and present findings at conferences.
• Participate in on-call or operational support as required by team ownership model.

Requirements

• Hands-on security experience in research, malware analysis, penetration testing, or security tooling with both developer and adversarial mindsets.
• Experience using AI in real work, including building with large language model APIs or agent frameworks like LangChain or LangGraph.
• Strong programming skills in Go or Python with best software engineering practices.
• Experience deploying and running production services on a public cloud.
• Understanding of package ecosystems and software supply chain attacks.
• Ability to map attack vectors, make data-driven decisions balancing quality and speed, and stay current with security and AI trends.
• Clear writing skills for diverse audiences.
• Basic high-level knowledge of compilers or static application security testing engines is sufficient.

Nice to haves

• Published vulnerability findings.
• Security research on AI agents, large language model applications, or Model Context Protocol (MCP) servers.
• Experience with Google Cloud Platform.
• Infrastructure as code experience using Terraform or OpenTofu.

Perks and benefits

• Benefits supporting health, finances, and well-being.
• Flexible Paid Time Off.
• Team Member Resource Groups for inclusion and support.
• Equity compensation and Employee Stock Purchase Plan.
• Growth and Development Fund for continuous learning.
• Parental leave programs.