Senior Security Researcher Open-Source Supply Chain Remote

TuxCare Inc.; Comunidad de Madrid; Remote; EUR 90,000 - 135,000; Full time

Benefits offered by this job

Fully remote work

Flexible working hours

Paid vacation and holidays

Private medical insurance

Job summary

TuxCare in Spain is seeking a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain. You will be the first engineer, building production-quality tools and pipelines to scale research for open-source software supply-chain security.

The role focuses on detecting malware, building AI-assisted detection pipelines and coordinating disclosure with upstream projects.

Qualifications

• Security research background: malware or software supply-chain research, vulnerability discovery and root-cause analysis.
• Strong Python or another suitable systems language; you build tools and pipelines that run in production.
• CI pipelines, test automation and operating services.
• Practical use of static analysis, fuzzing and sandboxing.
• Heavy, daily use of AI-assisted tools in research and engineering.
• Experience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).
• Clear research reports and experience with coordinated disclose.
• Advanced written and spoken English.

Responsibilities

• Own SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.
• Extending detection with artifact scanning, static signals, dynamic analysis and external intelligence.
• Building repeatable pipelines that discover new vulnerabilities in software that SecureChain and ELS support, with priority on high/critical risks and on EOL versions customers still use.
• Reproducing findings, proving impact and reachability, and storing evidence so another researcher can repeat the result.
• Developing AI-assisted methods to generate and test candidate fixes, and feeding them into our patch automation.
• Owning TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.
• Preparing technical write-ups and research publications together with Marketing.

Skills

Malware analysis

Vulnerability discovery

Python

Automation pipelines

Coordinated disclosure

AI-assisted tools

Tools

CI/CD tooling

Static analysis

Sandboxing

Job description

TuxCare in Spain is seeking a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain. You will be the first engineer, building production-quality tools and pipelines to scale research for open-source software supply-chain security.

The role focuses on detecting malware, building AI-assisted detection pipelines and coordinating disclosure with upstream projects.