Senior Application Security Researcher

Commit; Toronto; Vor Ort; CAD 120.000 - 190.000; Vollzeit

Zusammenfassung

Commit in Toronto, Canada is seeking a senior, hands-on Application Security Researcher to push modern AppSec forward—working with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is a build-and-break role, not a typical AppSec position.

This role focuses on practical security research, delivering production-grade Python/Go code, tuning detection logic, and communicating attack paths clearly to product teams.

Qualifikationen

• 5+ years hands-on in offensive security, vulnerability research, or application security.
• Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains.
• Strong coding in Python, Go, or similar, with production-quality code shipped.
• Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives.
• Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider.
• Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail.
• Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy.
• Takes research ideas from prototype to production with minimal guidance.
• Clear written communication — can explain a complex attack path to engineers and product managers.

Kenntnisse

Offensive security

Vulnerability research

Application security

Web & API security

Python

Go

Detection logic

SAST/DAST/SCA

Cloud platforms

CI/CD

Kubernetes

LLMs / AI models in security

Large datasets (SQL/BigQuery)

Effective communication

Ausbildung

M.Sc. in Computer Science or Cyber Security

Tools

Kubernetes

BigQuery

CI/CD tooling

Jobbeschreibung

The company secures the AI-driven SDLC from prompt to production, unifying development and cloud context to stop vulnerabilities at the source. The Security Research group is hiring a senior, hands‑on Application Security Researcher to push modern AppSec forward — working with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is a build-and-break role, not a typical AppSec position.

Requirements:

Must-have skills:

• 5+ years hands‑on in offensive security, vulnerability research, or application security
• Deep understanding of web application and API vulnerabilities, including business‑logic flaws and multi‑step attack chains
• Strong coding in Python, Go, or similar, with production‑quality code shipped
• Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives
• Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider
• Hands‑on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail
• Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy
• Takes research ideas from prototype to production with minimal guidance
• Clear written communication — can explain a complex attack path to engineers and product managers
• M.Sc. in Computer Science, Cyber Security, or a related field

Nice to have:

• Published research, CVEs, conference talks, or a bug bounty track record
• Experience building AI agents or evaluation frameworks for LLMs
• Background in exploit development, red teaming, or penetration testing
• Code analysis techniques (taint analysis, call graphs, reachability)
• Contributions to open-source security tools