Security research engineer in software supply chains

TuxCare Inc.; United States; Remote; USD 140,000 - 230,000; Full time

Benefits offered by this job

Fully remote

Flexible hours

Private medical insurance

Education budget

Co-working reimbursement

Gym reimbursement

Education budget

Job summary

TuxCare Inc. ищет старшего/ведущего инженера по исследованию безопасности для запуска функции Security Research & Automation в SecureChain.

Вы будете строить процессы обнаружения вредоносного кода и развивать конвейеры для выявления критических уязвимостей в поддерживаемом ПО. Удаленная работа с гибким графиком, компенсация медицинской страховки, образовательный бюджет и возможности публикаций в области безопасности.

Qualifications

• Опыт в исследовании угроз иSupply-chain
• Умение документировать исследования и результаты
• Опыт работы с раскрытием уязвимостей

Responsibilities

• Обнаружение вредоносного кода до публикации пакета
• Построение пайплайнов для поиска критических уязвимостей
• Публикация доказательств после координированного раскрытия
• Управление CNA и качеством записей CVE
• Расширение детекции на основе анализа артефактов и ИИ
• Создание повторяемых пайплайнов для обнаружения новых уязвимостей
• Доклады и публикации совместно с маркетингом

Skills

Исследование безопасности

Python

CI/CD конвейеры

Статический анализ

ИИ-инструменты

Опыт с несколькими экосистемами пакета

Скоординированное раскрытие

Английский язык

Tools

CVE базы данных

Job description

Описание:

TuxCare provides security solutions for Linux and open-source software used by enterprise organizations. Our products help companies automate vulnerability patching, reduce downtime, maintain security and compliance, and support critical systems throughout their lifecycle. We are looking for a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain.

Задачи:

• Detect malicious code before SecureChain publishes a package.
• Build pipelines that find and help fix high and critical vulnerabilities in maintained and end-of-life open-source software.
• Publish useful, evidence-backed security research after coordinated disclosure.
• Owning SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.
• Extending detection with artifact scanning, static signals, dynamic analysis and external intelligence.
• Building repeatable pipelines that discover new vulnerabilities in software that SecureChain and ELS support, with priority on high/critical risks and on EOL versions customers still use.
• Reproducing findings, proving impact and reachability, and storing evidence so another researcher can repeat the result.
• Developing AI-assisted methods to generate and test candidate fixes, and feeding them into our patch automation.
• Owning TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.
• Preparing technical write-ups and research publications together with Marketing.

Требования:

• Security research background: malware or software supply-chain research, vulnerability discovery and root-cause analysis.
• Strong Python or another suitable systems language; you build tools and pipelines that run in production.
• CI pipelines, test automation and operating services.
• Practical use of static analysis, fuzzing and sandboxing.
• Heavy, daily use of AI-assisted tools in research and engineering.
• Experience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).
• Clear research reports and experience with coordinated disclosure.
• Advanced written and spoken English.
• Будет плюсом: Published CVEs, advisories or security research; Experience with CNA operations or vulnerability databases (CVE, OSV)

Условия:

• A focus on professional development.
• Interesting and challenging projects.
• Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.
• Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.
• Compensation for private medical insurance.
• Co-working and gym/sports reimbursement.
• Budget for education.
• The opportunity to receive a reward for the most innovative idea that the company can patent.