Senior Application Security Researcher

🔥 9 minutes ago

🇨🇦 Canada – Remote

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 22%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Commit

WebsiteLinkedInAll Job Openings

501 - 1000 employees

🔒 Cybersecurity

Cybersecurity

Commit is a global tech services company founded in 2005, with a presence in Israel, the US, Canada, the UK, and Europe. It specializes in advanced technologies and applications, providing innovative, end-to-end technology solutions, including custom software and IoT platforms. Commit has over 700 multidisciplinary experts who cater to a wide array of companies, from startups to large enterprises, and focuses on areas like Cloud, GenAI, Software, IoT, Big Data, Cybersecurity, and data center migration. Its proprietary Flexible R&D methodology supports clients in transforming their technology visions into high-quality products while reducing costs and improving time-to-market.

📋 Description

• Conduct hands-on application security research to advance modern AppSec • Work with engineers, researchers, and AI/data scientists on next-generation detection • Develop autonomous, agentic penetration-testing capabilities • Build and break security systems rather than perform a typical AppSec role • Take research ideas from prototype through production

🎯 Requirements

• 5+ years hands-on in offensive security, vulnerability research, or application security • Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains • Strong coding in Python, Go, or similar, with production-quality code shipped • Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives • Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider • Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail • Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy • Takes research ideas from prototype to production with minimal guidance • Clear written communication — can explain a complex attack path to engineers and product managers • M.Sc. in Computer Science, Cyber Security, or a related field • Published research, CVEs, conference talks, or a bug bounty track record • Experience building AI agents or evaluation frameworks for LLMs • Background in exploit development, red teaming, or penetration testing • Code analysis techniques (taint analysis, call graphs, reachability) • Contributions to open-source security tools