Security Researcher and Red Team Engineer

HushOne, Inc.; Kirkland (WA); Sur place; USD 140 000 - 210 000; Plein temps

Avantages offerts par ce poste

Stock options

Annual performance bonus

Remote-friendly policy

Gym membership

Health, dental and vision coverage

401(k) with company match

Résumé du poste

HushOne, Inc. is seeking a security researcher to identify and explain flaws across hardware, software, and people, collaborating with teams to close gaps in a Kirkland, WA environment. You will drive authorized investigations, develop reproducible demonstrations, and communicate findings to enable rapid remediation.

The role emphasizes end-to-end testing, including human factors, with a remote-friendly policy and opportunities for stock-based incentives and strong benefits.

Qualifications

• Original security research, deep debugging, or high-quality vulnerability discovery.
• Explain findings clearly so the fix is obvious to teams.
• Collaborative approach rather than adversarial theatre.
• Test the whole system, including human factors.

Responsabilités

• Conduct authorized research into device compromise, sandbox boundaries, agent manipulation, data exposure and recovery abuse.
• Build reproducible demonstrations and work with owners on repairs and regression coverage.
• Follow agreed scope and coordinated vulnerability handling.
• Present a past finding with its root cause, practical impact, remediation and the assumptions that limited the test.
• Assist with remediation verification and regression coverage with product teams.

Connaissances

Original security research

Clear findings explanations

Collaborative teamwork

Full system testing

Description du poste

You find the failures that matter before a user does, testing the product as a connected system of hardware, software and people. Finding the flaw is half the role; explaining it clearly and working with the team to close it is the other half, and it is the half that decides whether the finding actually helps.

The work:

Conduct authorized research into device compromise, sandbox boundaries, agent manipulation, data exposure and recovery abuse. Build reproducible demonstrations and work with owners on repairs and regression coverage. Follow agreed scope and coordinated vulnerability handling.

What good looks like:

In your first 90 days, complete one scoped assessment with reproducible findings, impact analysis and verified remediation.

Evidence we look for:

Bring evidence of original security research, deep debugging or high-quality vulnerability discovery. Clear explanations and constructive collaboration are as important as finding a flaw.

Required:

• Original security research, deep debugging, or high-quality vulnerability discovery
• You explain a finding clearly enough that the fix is obvious to the team that owns it
• Constructive collaboration rather than adversarial theatre
• You test the whole system, including the human path, not only the code

Nice to have:

• Hardware as well as software research
• Published CVEs, or bug-bounty standing
• Social engineering or physical security assessment

The exercise:

Present a past finding with its root cause, practical impact, remediation and the assumptions that limited the test.

How we work:

We work together in the office, five days a week, and you can be based at any of our garages: Kirkland Garage (Kirkland, WA); UAE Garage (Dubai, Dubai). We hire across the United States, India and the UAE. We are remote-friendly around family: if you need to work from home some days to look after the people you love, we arrange that with you one person at a time, and we encourage people to use it rather than tough it out.

Pay:

We publish what we pay. Indicative ranges by market and level are on our compensation page, and they are realistic going market rates rather than headline numbers. Wherever we hire we pay at least the local market rate, and for full-time roles our floor is a living wage, never the statutory minimum. Compensation is reviewed every year and on promotion.

Equity:

Every full-time teammate gets stock options. Four-year vesting with a one-year cliff, sized to role, level and impact, and confirmed in writing at offer. High performers earn refresh grants.

Bonus and commission:

An annual performance bonus tied to clear company and personal goals, indicatively 10 to 20 percent of base for non-sales roles. Customer-facing roles carry on-target earnings, typically a 50/50 split of base and variable, with uncapped commission and accelerators above quota.

Health and peace of mind:

Medical, dental and vision for you and your family, plus life and disability cover. We have chosen the highest plan tier available to us rather than the cheapest one that clears the bar, because the point of this is that you never have to think about it. The specific plan numbers are confirmed in your offer letter.

401(k) with company matching:

A 401(k) with a company match, so the years you spend here compound into something that is yours whatever happens next. The match formula is confirmed in your offer letter.

AI tokens:

A budget of AI tokens of your own, because a company that says you should own your AI cannot be the company that rations it. Use them on the work and on whatever you are curious about.

Gym, and the everyday things:

A gym membership, and a corporate benefits programme with its own app, where you redeem real discounts with a long list of retailers on the ordinary purchases of a life.

Family:

We are remote-friendly around your family, arranged one person at a time, and we would rather you took it than toughed it out.

Referrals:

Refer someone we hire full-time who stays a year and you get $1,000 plus $10,000 in referral stock-based equity, on top of your own package.