Senior Security Researcher

Remotedxb; Dubai; On-site; AED 200,000 - 280,000; Full time

Job summary

Censys is seeking an experienced security researcher to advance offensive capabilities by scanning, fingerprinting, and analyzing attack surfaces. You will conduct original research on emergent techniques, publish findings, and collaborate with Engineering to translate discoveries into new scanning modules and detection features.

You will mentor teammates, work with large-scale Internet scan data, and contribute to research outputs such as CVEs, talks, and tools.

Qualifications

• 5+ years of hands-on penetration testing, red teaming, or adversary emulation.
• Ability to independently identify and characterize vulnerabilities and exploitation techniques.
• Strong understanding of network protocols and service fingerprinting.
• Hands-on experience with agentic systems for offensive security (e.g., HackSynth, RedTeamLLM, CAI, PentAG).
• Proficiency in scripting or coding with Python, Go, or similar.
• Familiarity with red team frameworks and tradecraft.
• Comfort working with large-scale Internet scan data.

Responsibilities

• Drive product capability by bringing an offensive practitioner's perspective to scanning, fingerprinting, and attack surface data.
• Conduct original research into emerging attack techniques, exploitation trends, and C2 infrastructure.
• Publish seminal work including research reports, technical blog posts, and conference-caliber material.
• Collaborate with Engineering and Product to translate research findings into new scanning modules and detection features.
• Lead agentic AI threat research, building and evaluating autonomous penetration testing agents and LLM-powered tools.
• Track adversary infrastructure and encode knowledge into repeatable detection logic.
• Mentor and act as an internal subject-matter expert on offensive techniques.

Skills

Penetration testing

Red teaming

Adversary emulation

Network fingerprinting

Python/Go scripting

Large-scale data handling

Education

OSCP

OSCE

OSEP

GXPN

Tools

HackSynth

RedTeamLLM

CAI

PentAG

Job description

About the Company

Censys’ mission is to be the one place to understand everything on the internet. Today, Censys delivers real-time Internet intelligence and actionable threat insights to global governments, over 50% of the Fortune 500, and leading threat intelligence providers worldwide.

Responsibilities

• Drive product capability by bringing an offensive practitioner's perspective to scanning, fingerprinting, and attack surface data
• Conduct original research into emerging attack techniques, exploitation trends, and C2 infrastructure
• Publish seminal work including research reports, technical blog posts, and conference-caliber material
• Collaborate with Engineering and Product to translate research findings into new scanning modules and detection features
• Lead agentic AI threat research, building and evaluating autonomous penetration testing agents and LLM-powered tools
• Track adversary infrastructure and encode knowledge into repeatable detection logic
• Mentor and act as an internal subject-matter expert on offensive techniques

Requirements

• 5+ years of hands-on penetration testing, red teaming, or adversary emulation experience
• Demonstrated ability to independently identify and characterize vulnerabilities and exploitation techniques
• Strong understanding of network protocols and service fingerprinting
• Hands-on experience with agentic systems for offensive security (e.g., HackSynth, RedTeamLLM, CAI, PentAG)
• Proficiency in scripting or coding with Python, Go, or similar
• Familiarity with red team frameworks and tradecraft
• Comfort working with large-scale Internet scan data

Preferred Qualifications

• Relevant certifications such as OSCP, OSCE, OSEP, or GXPN
• Experience with IoT, OT/ICS, or embedded device security research
• Prior work as a researcher at a security vendor
• Track record of public research output including CVEs, conference talks, or tool releases
• Familiarity with compliance-adjacent security testing (SOC 2, ISO 27001, or CMMC)