Senior Security Researcher

present of AI; United States; On-site; USD 140,000 - 190,000; Full time

Job summary

Endor Labs in the United States is seeking an offensive security researcher focused on the software supply chain. You will hunt zero-day flaws in packages, third-party libraries, and CI/CD pipelines, and model attacker paths to craft effective detections and fixes.

Clear writing and communication are as important as depth of technical skill, as you will collaborate with product teams to turn findings into practical security controls and public research once disclosures are ready.

Qualifications

• Years of hands-on vulnerability discovery, reverse engineering and exploit work.
• Record of responsible disclosure and public research.

Responsibilities

• Hunt zero-day flaws in software packages, third-party libraries, and CI/CD pipelines.
• Collaborate with product teams to convert findings into detections and fixes.

Job description

The role is offensive security research aimed at the software supply chain: hunting zero day flaws in packages, third party libraries and build pipelines, and working out how attackers would exploit them. A strong candidate brings years of hands on vulnerability discovery, reverse engineering and exploit work, plus a record of responsible disclosure and public research. The job also asks for close work with product teams to turn findings into detection and fixes, so clear writing and speaking matter as much as technical depth.

How it fits the AI era

AI coding agents now produce code faster than people can review it, and the posting says much of that output is insecure, so the research focus shifts toward threats that arrive at machine speed. The work of finding, proving and explaining real exploitable flaws stays human, and so does judging which findings matter and turning them into fixes that hold up. AI can speed up triage and pattern spotting, but the judgment and the evidence still come from the researcher.

How it builds AI experience

This role builds AI experience by studying how coding agents introduce and spread insecure code, and by probing the hooks, skills and model context protocol surfaces the company uses to watch agent actions. A candidate can prepare by learning how agent tooling and code generation pipelines work, then testing them for supply chain weaknesses and documenting results. Publishing that work adds to the public record on securing AI written software.

Worth showing

• Supply chain and CI/CD
• Conference or published research

This is our own read, written from the employer's posting and the company's Spotlight. The employer's posting is the source of truth for the role.

Per the company, Endor Labs provides an agentic application security platform that secures AI-generated code, open source dependencies, and containers.