Senior Offensive Security Researcher - AppSec & DAST

Invicti; Northern (KY); Hybrid; USD 150,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Parental leave

401(k) with company match

Hybrid schedule

Thrive-Wellness Days

Volunteer time off

Birthday off

Job summary

Invicti is seeking an experienced security researcher to turn vulnerability knowledge into detection content and ship high-quality checks. You will own detection rules, research modern attack techniques, and help advance the product through AI, cloud-native, and web security capabilities.

You will collaborate with engineering, product, and platform teams to ensure research output ships and remains operable. A hands-on attitude and sustained curiosity are essential for success in this role.

Qualifications

• 8+ years of offensive security or application security research experience (Bachelor's + 5 years, or Master's + 3 years).
• Broad knowledge of programming languages — JavaScript is a must, Python is a huge plus.
• Strong understanding of security principles, standards, and best practices.
• Deep understanding of vulnerability classifications, exploitation methodologies, and secure software development practices.
• Complete knowledge and full understanding of detection writing for DAST scanners, fuzzers, or comparable systems — including detection logic, response interpretation, and false-positive management.

Responsibilities

• Create new detection rules (primarily OpenGrep) to catch novel malware and vulnerability patterns and boost detection accuracy.
• Extend support for new programming languages across our analysis pipeline.
• Explore and experiment with cutting-edge tools and techniques to detect threats and malware at scale.
• Research novel ways to exploit and analyze modern web applications and APIs — building proof-of-concept attacks and translating findings into shippable capabilities.
• Research new vulnerability classes, exploitation techniques, cloud-native attack paths, and AI-specific attack vectors, and convert research into production-ready detections.

Skills

JavaScript

Python

Offensive security

Detection writing

OWASP Top 10

Burp Suite

Cloud platforms

Kubernetes

CI/CD security

English fluency

Education

Bachelor's degree in a related field

Master's degree in a related field

Tools

OpenGrep

Semgrep

Burp Suite

sqlmap

nmap

ffuf

Custom payloads

Job description

Invicti is seeking an experienced security researcher to turn vulnerability knowledge into detection content and ship high-quality checks. You will own detection rules, research modern attack techniques, and help advance the product through AI, cloud-native, and web security capabilities.

You will collaborate with engineering, product, and platform teams to ensure research output ships and remains operable. A hands-on attitude and sustained curiosity are essential for success in this role.