Senior Security Research Engineer, Remote OSS Supply Chain

TuxCare Inc.; United States; Remote; USD 150,000 - 230,000; Full time

Benefits offered by this job

Remote work

Flexible hours

Vacation days (24)

National holidays (10)

Medical insurance

Education budget

Gym reimbursement

Job summary

TuxCare Inc. is seeking a Senior/Principal Security Research Engineer to start the Security Research & Automation function for SecureChain, the open-source software supply chain security product.

You will lead research-first tooling, build production pipelines, and publish evidence-backed security research with coordinated disclosure. You will own the malicious-code detector, extend detection, and develop AI-assisted fixes while coordinating CNA activities and writing technical reports with

Qualifications

• Security research background with malware or software supply-chain focus.
• Experience in vulnerability discovery and root-cause analysis.
• Clear written reports and coordination of disclosure.
• Strong Python or comparable systems language for tooling.
• Excellent written and spoken English.

Responsibilities

• Own SecureChain’s malicious-code detector, including review workflow and metrics.
• Extend detection with static signals, dynamic analysis and external intelligence.
• Build repeatable pipelines to discover new vulnerabilities in OSS and EOL versions.
• Reproduce findings and store evidence for repeatability.
• Develop AI-assisted methods to generate and test fixes and support patch automation.
• Coordinate disclosure with upstream projects and CNA work.
• Prepare technical write-ups and research publications with Marketing.

Skills

Security research

Malware analysis

Vulnerability discovery

Coordinated disclosure

English communication

Tools

Static analysis tooling

Fuzzing

Sandboxing

Job description

TuxCare Inc. is seeking a Senior/Principal Security Research Engineer to start the Security Research & Automation function for SecureChain, the open-source software supply chain security product.

You will lead research-first tooling, build production pipelines, and publish evidence-backed security research with coordinated disclosure. You will own the malicious-code detector, extend detection, and develop AI-assisted fixes while coordinating CNA activities and writing technical reports with