Security Researcher

Zeropath; USA; Remote; USD 140.000 - 180.000; Vollzeit

Zusammenfassung

Zeropath is seeking a security researcher to audit open-source and client code, validate AI-assisted findings, and strengthen scanning rules. You will blend manual review with vulnerability triage, contribute to CVE processes, and publish research to advance secure coding practices.

You'll work remotely within the United States on impactful projects across languages like Python, JavaScript/TypeScript, Go, Java, and C/C++.

Qualifikationen

• At least 3 years of experience in app security research, pentesting, or red teaming.
• Proven success disclosing vulnerabilities via CVEs, bug bounties, or published research.
• Strong knowledge of OWASP risks, authorization bypasses, injection, and business-logic flaws.
• Ability to analyze source code in Python, JavaScript/TypeScript, Go, Java, or C/C++.
• Experience with static analysis concepts, code review, and auditing.
• Strong written communication for technical reports.

Aufgaben

• Investigate software projects and customer codebases for security vulnerabilities across languages.
• Validate and prioritize scanner findings, distinguishing genuine issues from false positives.
• Write vulnerability reports and coordinate responsible disclosure and CVE assignment.
• Refine detection rules, heuristics, and prompt strategies based on research results.
• Collaborate with engineers to improve detection of authorization and business-logic flaws.
• Contribute research write-ups for public-facing security publications.

Kenntnisse

Vuln research

Static analysis

Code review

Threat modeling

Ausbildung

Bachelor's in CS/Security

Tools

Semgrep

CodeQL

Tree-sitter

Jobbeschreibung

Role overview

Research vulnerabilities in open-source and customer code, assess findings from an AI-assisted scanner, and use that research to improve future detection. The work combines manual source-code auditing with vulnerability triage and collaboration on the rules and strategies used by the scanning engine.

Responsibilities

• Investigate software projects and customer codebases for security vulnerabilities across multiple languages.


• Validate and prioritize scanner findings, helping distinguish genuine issues from false positives.


• Write clear vulnerability reports and coordinate responsible disclosure and CVE assignment.


• Refine detection rules, heuristics, and prompt strategies based on research results.


• Work with engineers to improve detection of authorization and business-logic flaws.


• Contribute research write-ups for public-facing security publications.

Requirements

• At least three years of experience in application security research, penetration testing, or red teaming.


• Demonstrated success finding and responsibly disclosing vulnerabilities through CVEs, bug bounties, or published research.


• Strong knowledge of common vulnerability classes, including OWASP risks, authorization bypasses, injection, and business-logic flaws.


• Ability to analyze source code in languages such as Python, JavaScript or TypeScript, Go, Java, or C/C++.


• Experience with static analysis concepts, code review, and source-code auditing.


• Strong written communication for technical reports and research findings.

Nice to have

• Published CVEs or a substantial bug-bounty record.


• Familiarity with code-analysis tools such as tree-sitter, Semgrep, or CodeQL.


• Experience with AI-assisted security research or contributions to open-source security projects.

Benefits and work setup

• Full-time role, remote within the United States.


• Compensation of $140,000–$180,000 plus equity.