Senior Security Research Engineer (SecureChain)

TuxCare; Województwo mazowieckie; Remote; PLN 140,000 - 210,000; Full time

Benefits offered by this job

Fully remote work

Paid vacation 24 days

Private medical insurance

Co-working & gym reimbursement

Education budget

Patent reward program

Flexible working hours

Job summary

TuxCare is seeking a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain. You will lead as the first engineer, building production-grade tools and pipelines to scale research in a fully remote role.

You will own SecureChain's detectors, extend them with analytics, reproduce findings with evidence, and publish research after coordinated disclosure. English required; AI-assisted tooling central to workflows.

Qualifications

• Security research background in malware or software supply-chain.
• Strong Python or other systems language; build production tools.
• CI pipelines, test automation and operating services.
• Familiar with static analysis, fuzzing and sandboxing.
• Experience with multiple package ecosystems (PyPI, npm, Maven, Go).

Responsibilities

• Own SecureChain's malicious-code detector and its review workflow.
• Extend detection with artifact scanning, static signals and external intelligence.
• Build repeatable pipelines to discover new high/critical vulnerabilities.
• Reproduce findings with evidence and enable coordinated disclosure.
• Develop AI-assisted methods to generate and test fixes.
• Coordinate CNA work and CVE assignments with upstream projects.
• Prepare technical write-ups and publications with Marketing.

Skills

Python

CI pipelines

Static analysis

Fuzzing

Sandboxing

AI-assisted tooling

Multiple ecosystems

English proficiency

Job description

TuxCare provides security solutions for Linux and open-source software used by enterprise organizations. Our products help companies automate vulnerability patching, reduce downtime, maintain security and compliance, and support critical systems throughout their lifecycle.

Learn more about TuxCare: tuxcare.com

We are looking for a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain.

SecureChain is TuxCare's open-source software supply chain security product. It provides packages rebuilt from verified source code, scanned for malware and supply chain risks.

Learn more: tuxcare.com/securechain-for-oss

The Mission

You will be the first engineer of a new function, with a plan to grow it to three or four people. You are a security researcher first, and you build production-quality tools and pipelines to scale your research.

The function has three goals:

1. Detect malicious code before SecureChain publishes a package.
2. Build pipelines that find and help fix high and critical vulnerabilities in maintained and end-of-life open-source software.
3. Publish useful, evidence-backed security research after coordinated disclosure.

You will be responsible for:

• Owning SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.
• Extending detection with artifact scanning, static signals, dynamic analysis and external intelligence.
• Building repeatable pipelines that discover new vulnerabilities in software that SecureChain and ELS support, with priority on high/critical risks and on EOL versions customers still use.
• Reproducing findings, proving impact and reachability, and storing evidence so another researcher can repeat the result.
• Developing AI-assisted methods to generate and test candidate fixes, and feeding them into our patch automation.
• Owning TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.
• Preparing technical write-ups and research publications together with Marketing.

Your first 90 days:

• Days 1–30: take over the malicious-code detector, its sample review and CNA responsibilities; inventory services, data, prompts, corpus and open work.
• Days 31–60: improve the detector and its review workflow, measure alert volume, false positives and cost; start a vulnerability-discovery pilot on 5–10 packages of one ecosystem.
• Days 61–90: expand discovery across the ecosystem, complete coordinated disclosure where applicable, publish the first research output.

Must-haves:

• Security research background: malware or software supply-chain research, vulnerability discovery and root-cause analysis.
• Strong Python or another suitable systems language; you build tools and pipelines that run in production.
• CI pipelines, test automation and operating services.
• Practical use of static analysis, fuzzing and sandboxing.
• Heavy, daily use of AI-assisted tools in research and engineering.
• Experience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).
• Clear research reports and experience with coordinated disclosure.
• Advanced written and spoken English.

Nice-to-haves:

• Published CVEs, advisories or security research.
• Experience with CNA operations or vulnerability databases (CVE, OSV).

This is not a SOC analyst, compliance, penetration testing or general software development role.

What's in it for you?

• A focus on professional development.
• Interesting and challenging projects.
• Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.
• Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.
• Compensation for private medical insurance.
• Co-working and gym/sports reimbursement.
• Budget for education.
• The opportunity to receive a reward for the most innovative idea that the company can patent.

By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy ( https://tuxcare.com/privacy-policies-hub/candidate-privacy-notice/ ), which provides detailed information on how we maintain and handle your data.