Staff Security Researcher

Lever, Inc.; España; A distancia; EUR 110.000 - 170.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Fully remote Europe

Health benefits

Pension

Wellness days

Volunteer days

Birthday off

Career development

Flexible remote

Total rewards

Descripción de la vacante

Lever, Inc. is seeking a Staff Security Researcher in Spain to drive hands-on offensive security research and produce production-ready detections for web apps, APIs, cloud-native environments, and AI-powered systems.

You will translate discoveries into low-false-positive security checks, extend capabilities across languages, and contribute to research standards while collaborating with cross-functional teams. This remote role offers ownership in a fast-evolving security landscape.

Formación

• 8+ years in offensive security or application security research, or equivalent with a relevant degree.
• Broad programming knowledge with strong JavaScript required; Python valued.
• Experience writing detection logic for DAST scanners, fuzzers, or security tooling.
• Experience designing testing frameworks, evaluation harnesses, or large-scale validation systems.
• Strong web app pentesting across OWASP Top 10, REST, GraphQL, and modern API surfaces.

Responsabilidades

• Create and maintain detection rules, primarily using OpenGrep, to identify novel malware and vulnerabilities.
• Extend analysis capabilities to support more languages in the pipeline.
• Research vulnerabilities, exploitation techniques, cloud-native paths, and AI threats; translate into production detections.
• Develop attack-chain templates and evaluation harnesses to measure coverage and false positives.
• Collaborate with engineering, product, AI/ML, and infra teams to deploy research outputs.

Conocimientos

JavaScript

Python

Offensive security

Security research

Educación

Bachelor's or Master's degree in a relevant field

Herramientas

Burp Suite

sqlmap

nmap

ffuf

OpenGrep

Semgrep

YARA

Descripción del empleo

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Security Researcher based in Spain.

This role is designed for a hands-on offensive security researcher who can turn advanced vulnerability and malware research into production-ready detection capabilities. You will investigate emerging threats across web applications, APIs, cloud-native environments, and AI-powered systems, translating discoveries into accurate security checks with low false-positive rates. The position combines deep technical research with practical engineering, from exploit proof-of-concepts to detection rules, evaluation frameworks, and attack-chain methodologies. You will also contribute to research standards, security tooling, and the broader application security community through publications and technical contributions. Working across engineering, product, AI/ML, and infrastructure teams, you will help ensure research moves efficiently from discovery to production. The role offers a high degree of ownership in a fast-evolving security environment where technical curiosity and measurable detection quality are highly valued.

Accountabilities

• Create and maintain detection rules, primarily using OpenGrep, to identify novel malware and vulnerability patterns and improve detection accuracy.
• Extend security analysis capabilities to support additional programming languages across the analysis pipeline.
• Research emerging vulnerabilities, exploitation techniques, cloud-native attack paths, and AI-specific threats, translating findings into production-ready detections.
• Investigate modern web applications and APIs, develop proof-of-concept attacks, and convert research findings into deployable security capabilities.
• Develop attack-chain templates that connect lower-severity findings into meaningful exploitation paths.
• Design and maintain evaluation harnesses, testing frameworks, and benchmarks to measure coverage, accuracy, exploit reproducibility, and false-positive rates.
• Triage complex findings and packages from the analysis pipeline and validate detection results.
• Apply established detection and exploitation principles while contributing to new research standards, policies, and attack methodologies.
• Explore emerging tools and techniques for detecting threats and malware at scale.
• Research security topics across AppSec, AI red-teaming, offensive AI, LLM vulnerabilities, agent security, MCP security, and cloud-native attack techniques.
• Contribute to internal research initiatives and help shape future security research priorities.
• Publish technical research through blog posts, CVEs, advisories, tool releases, and conference contributions where appropriate.
• Mentor junior and mid-level security researchers on detection writing and exploitation techniques.
• Collaborate with engineering, product, AI/ML, infrastructure, platform, and security teams to ensure research outputs are successfully deployed and maintained.
• Help improve security automation across CI/CD and cloud-native environments while maintaining high detection quality.

Requirements

• 8+ years of experience in offensive security or application security research, or equivalent experience supported by a relevant Bachelor's or Master's degree.
• Broad programming knowledge, with strong JavaScript skills required and Python experience highly valued.
• Deep understanding of security principles, standards, best practices, vulnerability classifications, exploitation methodologies, and secure software development.
• Extensive experience writing detection logic for DAST scanners, fuzzers, or comparable security systems, including response interpretation and false-positive management.
• Experience designing testing frameworks, evaluation harnesses, or large-scale validation systems for security tooling.
• Strong web application penetration-testing experience covering the OWASP Top 10, authentication, authorization, business logic, REST, GraphQL, and modern API surfaces.
• Ability to tackle complex technical and algorithmic problems, including parsing and AST-based analysis.
• Strong hands-on experience with offensive security tools such as Burp Suite, sqlmap, nmap, ffuf, and custom payload-generation techniques.
• Solid understanding of HTTP and web protocol fundamentals.
• Experience with cloud platforms, Kubernetes, containers, infrastructure-as-code, and CI/CD security is highly desirable.
• Practical experience researching or securing LLM-powered applications, AI agents, or AI-assisted development workflows, including prompt injection, model abuse, tool invocation risks, MCP security, and emerging AI attack techniques.
• Fluent English with strong written and verbal communication skills and the ability to explain complex technical topics to both technical and non-technical audiences.
• Strong collaboration skills and sound judgment when determining when issues require escalation.
• Hands-on mindset, intellectual curiosity, and willingness to research across traditional application security, cloud-native security, and rapidly evolving AI security domains.
• Experience with OpenGrep or Semgrep, static analysis, production-ready security systems, YARA, or public security research such as CVEs, advisories, talks, or open-source tools is a plus.

Benefits

• Fully remote work from Europe, with the role open to candidates working within CET ±2 hours.
• Health, pension, and statutory benefits tailored to your country of residence.
• 24/7 Employee Assistance Program offering emotional support, life coaching, dependent and elder care, financial and legal support, wellness coaching, and new-parent support.
• Quarterly wellness days providing an additional day off each quarter for rest and rejuvenation.
• 5 paid volunteer days per year to support charitable or community activities of your choice.
• Paid birthday day off.
• Employee recognition and rewards programs.
• A culture focused on personal and professional development.
• Flexible, remote working environment designed to support work-life balance.
• Competitive compensation and a broader total-rewards approach adapted to regional needs.
• Opportunities to contribute to meaningful security research and develop expertise across application security, cloud, and AI security.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.