Security Researcher

Have I Been Squatted, Inc.; Polska; Hybrid; PLN 263,000 - 394,000; Full time

Benefits offered by this job

Remote work

Equipment budget

Job summary

Have I Been Squatted, Inc. is seeking a Security Researcher to deepen attacker-tactic understanding, improve detection quality, and help customers prioritize risks.

This remote-first role welcomes overlap-friendly hours across UTC-adjacent time zones and values concise, evidence-based analysis. You will work with a small, senior team to validate hypotheses, design research workflows, and communicate findings both internally and to the broader security community.

Qualifications

• Hands-on experience investigating phishing, brand impersonation, or domain abuse.
• Comfort working with structured data, logs, and OSINT sources.
• Strong written communication: explain trade-offs and uncertainty without hype.
• A collaborative mindset; eager to iterate quickly and learn from production feedback.

Responsibilities

• Analyze domain using hundreds of data signals to identify abuse patterns and high-risk registrations.
• Build and refine research notes, playbooks, and lightweight tooling for repeatable investigations.
• Partner with engineering to improve detection logic and data coverage.
• Support customer-facing teams with technical context for complex cases and escalations.
• Contribute to responsible disclosure practices and clear documentation of research outcomes.

Skills

Phishing investigations

Domain abuse OSINT

Structured data analysis

Written communication

Team collaboration

Rust / SQL / notebooks

Tools

Threat intel feeds

Certificate transparency

Job description

# Security Researcher**Have I Been Squatted** helps security teams find and stop malicious domains before they become incidents. As a Security Researcher, you will deepen our understanding of attacker tactics, improve detection quality, and help customers prioritise what matters.You will work closely with engineering and product to validate hypotheses, design research workflows, and communicate findings clearly, both internally and, where appropriate, to the broader security community.TypeRemoteRegionEU + UKTimezoneUTC to UTC+1Remote from Poland, Kosovo, Romania, Austria, Czechia, Croatia, Bulgaria, Italy, United Kingdom or other UTC-adjacent locationsApply nowWhat we offer* Remote-first role with overlap-friendly hours across UTC-adjacent time zones* Small, senior team with direct impact on product direction and customer outcomes* Modern stack and room to propose better ways to research and ship* Competitive compensation and equipment budget appropriate to the roleNice to have* Experience with certificate transparency, passive DNS, or threat intel feeds* Familiarity with Rust, SQL, or data analysis notebooks for ad-hoc research* Prior work in a product-led security or SaaS environmentAll open roles### What you will do* 00Analyze domain leveraging hundreds of data signals to identify abuse patterns and high-risk registrations* 01Build and refine research notes, playbooks, and lightweight tooling to speed up repeatable investigations* 02Partner with engineering to improve detection logic, data coverage, and analyst-facing workflows* 03Support customer-facing teams with technical context for complex cases and escalations* 04Contribute to responsible disclosure practices and clear documentation of research outcomes### What we're looking for* 00Hands-on experience investigating phishing, brand impersonation, or domain abuse* 01Comfort working with structured data, logs, and open-source intelligence (OSINT) sources* 02Strong written communication: you can explain trade-offs and uncertainty without hype* 03A collaborative mindset; you are happy to iterate quickly and learn from production feedback## Interested in this role?Send a short introduction, your resume, and a link that showcases your work. We reply when there's a fit.