Remote Senior Security Research Engineer – OSS Supply Chain

TuxCare Inc.; Madrid; Remote; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Remote work worldwide

Flexible hours

Paid vacation 24 days per year

Private medical insurance

Co-working and gym/sports reimburse.

Education budget

Patent reward for innovative ideas

Job summary

TuxCare Inc. is seeking a Senior / Principal Security Research Engineer to launch the Security Research & Automation function of SecureChain. You will be the first engineer in a new team, building production-grade tools for research and automation.

Responsibilities include owning the malicious-code detector, extending detection with static/dynamic analysis, coordinating disclosure, and publishing evidence-backed security research with Marketing. Fully remote options available.

Qualifications

• Security research background in malware or software supply-chain research.
• Strong Python or other systems language; you build tools and pipelines that run in production.
• CI pipelines, test automation and operating services.
• Advanced written and spoken English.
• Experience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).

Responsibilities

• Own SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.
• Extend detection with artifact scanning, static signals, dynamic analysis and external intelligence.
• Build repeatable pipelines that discover new vulnerabilities in software that SecureChain and ELS support, with priority on high/critical risks and on EOL versions customers still use.
• Reproducing findings, proving impact and reachability, and storing evidence so another researcher can repeat the result.
• Developing AI-assisted methods to generate and test candidate fixes, and feeding them into our patch automation.
• Owning TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.
• Preparing technical write-ups and research publications together with Marketing.

Skills

Security research

Python

CI pipelines

Static analysis

Fuzzing

AI-assisted tools

Multi-ecosystem experience

Technical reporting

English language

Job description

TuxCare Inc. is seeking a Senior / Principal Security Research Engineer to launch the Security Research & Automation function of SecureChain. You will be the first engineer in a new team, building production-grade tools for research and automation.

Responsibilities include owning the malicious-code detector, extending detection with static/dynamic analysis, coordinating disclosure, and publishing evidence-backed security research with Marketing. Fully remote options available.