we are looking for a Senior Vulnerability Researcher.
You'll have the room to follow the research where it leads, and the backing of an ecosystem created to set you up for success by providing every tool and access that could help.
Some threads will feed directly into how understands what's genuinely exploitable, grounding the platform in real attacker reality rather than theoretical risk. Others will be pure discovery, pursued because the problem is hard and the finding truly matters, and published to move the field forward.
Either way, your work establishes authority in the field. Through original research, disclosures, and technical thought leadership, you'll build a body of work that earns the respect of the security community and sharpens how the industry thinks about what's truly secure.
What you will Do:
Hunt for what established security paradigms miss: flawed assumptions, gaps between specified and actual behavior, and novel vulnerability classes and exploitation techniques that don't yet have names.
Reverse-engineer and deeply understand systems, protocols, and architectures at the implementation level - developing a precise understanding of how they actually work, rather than what their designers intended.
Develop hypotheses and convert them into working proof-of-concept exploits that demonstrate real-world risk before attackers do.
Own research threads end-to-end, from an early exploration, developing and following hunches all the way through to a proof of concept, responsible disclosure or publication, following the evidence wherever it leads without waiting for a defined playbook.
Ground understanding of exploitability in attacker reality - when research surfaces findings relevant to how the platform models identity attack surface across human and non-human identities, bring that signal in.
Promote standing in the security community through original research, CVEs, and technical thought leadership that advances the field and earns trust on its merits.
Requirements: 6+ years of hands-on vulnerability research, reverse engineering, or offensive security, with a proven track record of finding non-trivial flaws and the depth in systems, protocols, and architectures to understand precisely why they exist.
A first-principles approach to how things actually work, not how they're documented to work: you pull the thread until you hit ground truth, and you're not satisfied until you do.
The instinct and ability to see what others overlook - the unquestioned assumptions in established systems, the edges no one has tested, the failure modes that live in the gap between spec and implementation.
End-to-end ownership of research: you drive hypotheses to conclusions through dead ends, changes of directions and reach hard proofs
Strong hands-on expertise, converting theories and research into a working chain and proof of concept.
Result driven depth: you go as far as a problem deserves, because the result is worth it, and you know when it is.
A track record of original significant discoveries - published CVEs, novel vulnerability classes or exploitation techniques, research that named a problem the field didn't have words for yet.
This position is open to all candidates.