Staff Security Researcher

Jobgether SRL; Schweiz; À distance; CHF 120 000 - 170 000; Plein temps

Avantages offerts par ce poste

Fully remote work from Europe

Health and pension benefits

Annual wellness days

Résumé du poste

Jobgether SRL in Switzerland is seeking a Staff Security Researcher to lead hands-on research translating vulnerability findings into production-grade detections across web apps, APIs, cloud-native environments, and AI systems.

You will author detection rules with OpenGrep, extend analysis pipelines to more languages, and mentor junior researchers while collaborating with AI/ML, product, and infrastructure teams to deploy and scale security research.

Qualifications

• 8+ years of experience in offensive security or application security research.
• Broad programming knowledge with strong JavaScript skills and Python valued.
• Deep understanding of security principles, standards, and exploitation methodologies.
• Experience writing detection logic for DAST scanners, fuzzers, or related systems.
• Experience designing testing frameworks, evaluation harnesses, or large-scale validation systems.
• Strong web app pentesting experience covering OWASP Top 10 and modern APIs.
• Hands-on with tools like Burp Suite, sqlmap, nmap, ffuf, and custom payloads.
• Fluent English with clear communication; ability to explain complex topics.

Responsabilités

• Create and maintain detection rules using OpenGrep to identify malware and vulnerabilities.
• Extend security analysis capabilities to support more languages in the pipeline.
• Research emerging threats and translate findings into production-ready detections.
• Develop PoC attacks for web apps and APIs, turning research into deployable security capabilities.
• Design attack-chain templates linking findings to exploitation paths.
• Build evaluation harnesses to measure coverage, accuracy, and false positives.
• Triage complex findings from the analysis pipeline and validate results.
• Collaborate with engineering, product, AI/ML, and infra teams to deploy outputs.
• Explore tools and techniques for detecting threats at scale.
• Publish research through blogs, CVEs, advisories, and open-source contributions.

Connaissances

JavaScript

Python

Security research

Threat detection

Penetration testing

Cross-functional collaboration

Communication skills

Formation

Bachelor's or Master's degree in a relevant field

Outils

Burp Suite

sqlmap

nmap

ffuf

OpenGrep

Semgrep

YARA

Description du poste

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Security Researcher based in Switzerland.

This role is designed for a hands-on offensive security researcher who can turn advanced vulnerability and malware research into production-ready detection capabilities. You will investigate emerging threats across web applications, APIs, cloud-native environments, and AI-powered systems, translating discoveries into accurate security checks with low false-positive rates. The position combines deep technical research with practical engineering, from exploit proof-of-concepts to detection rules, evaluation frameworks, and attack-chain methodologies. You will also contribute to research standards, security tooling, and the broader application security community through publications and technical contributions. Working across engineering, product, AI/ML, and infrastructure teams, you will help ensure research moves efficiently from discovery to production. The role offers a high degree of ownership in a fast-evolving security environment where technical curiosity and measurable detection quality are highly valued.

• Create and maintain detection rules, primarily using OpenGrep, to identify novel malware and vulnerability patterns and improve detection accuracy.
• Extend security analysis capabilities to support additional programming languages across the analysis pipeline.
• Research emerging vulnerabilities, exploitation techniques, cloud-native attack paths, and AI-specific threats, translating findings into production-ready detections.
• Investigate modern web applications and APIs, develop proof-of-concept attacks, and convert research findings into deployable security capabilities.
• Develop attack-chain templates that connect lower-severity findings into meaningful exploitation paths.
• Design and maintain evaluation harnesses, testing frameworks, and benchmarks to measure coverage, accuracy, exploit reproducibility, and false-positive rates.
• Triage complex findings and packages from the analysis pipeline and validate detection results.
• Apply established detection and exploitation principles while contributing to new research standards, policies, and attack methodologies.
• Explore emerging tools and techniques for detecting threats and malware at scale.
• Research security topics across AppSec, AI red-teaming, offensive AI, LLM vulnerabilities, agent security, MCP security, and cloud-native attack techniques.
• Contribute to internal research initiatives and help shape future security research priorities.
• Publish technical research through blog posts, CVEs, advisories, tool releases, and conference contributions where appropriate.
• Mentor junior and mid-level security researchers on detection writing and exploitation techniques.
• Collaborate with engineering, product, AI/ML, infrastructure, platform, and security teams to ensure research outputs are successfully deployed and maintained.
• Help improve security automation across CI/CD and cloud-native environments while maintaining high detection quality.

Requirements

• 8+ years of experience in offensive security or application security research, or equivalent experience supported by a relevant Bachelor's or Master's degree.
• Broad programming knowledge, with strong JavaScript skills required and Python experience highly valued.
• Deep understanding of security principles, standards, best practices, vulnerability classifications, exploitation methodologies, and secure software development.
• Extensive experience writing detection logic for DAST scanners, fuzzers, or comparable security systems, including response interpretation and false-positive management.
• Experience designing testing frameworks, evaluation harnesses, or large-scale validation systems for security tooling.
• Strong web application penetration-testing experience covering the OWASP Top 10, authentication, authorization, business logic, REST, GraphQL, and modern API surfaces.
• Ability to tackle complex technical and algorithmic problems, including parsing and AST-based analysis.
• Strong hands-on experience with offensive security tools such as Burp Suite, sqlmap, nmap, ffuf, and custom payload-generation techniques.
• Solid understanding of HTTP and web protocol fundamentals.
• Experience with cloud platforms, Kubernetes, containers, infrastructure-as-code, and CI/CD security is highly desirable.
• Practical experience researching or securing LLM-powered applications, AI agents, or AI-assisted development workflows, including prompt injection, model abuse, tool invocation risks, MCP security, and emerging AI attack techniques.
• Fluent English with strong written and verbal communication skills and the ability to explain complex technical topics to both technical and non-technical audiences.
• Strong collaboration skills and sound judgment when determining when issues require escalation.
• Hands-on mindset, intellectual curiosity, and willingness to research across traditional application security, cloud-native security, and rapidly evolving AI security domains.
• Experience with OpenGrep or Semgrep, static analysis, production-ready security systems, YARA, or public security research such as CVEs, advisories, talks, or open-source tools is a plus.

Benefits

• Fully remote work from Europe, with the role open to candidates working within CET ±2 hours.
• Health, pension, and statutory benefits tailored to your country of residence.
• 24/7 Employee Assistance Program offering emotional support, life coaching, dependent and elder care, financial and legal support, wellness coaching, and new-parent support.
• Quarterly wellness days providing an additional day off each quarter for rest and rejuvenation.
• 5 paid volunteer days per year to support charitable or community activities of your choice.
• Paid birthday day off.
• Employee recognition and rewards programs.
• A culture focused on personal and professional development.
• Flexible, remote working environment designed to support work-life balance.
• Competitive compensation and a broader total-rewards approach adapted to regional needs.
• Opportunities to contribute to meaningful security research and develop expertise across application security, cloud, and AI security.