Senior/Staff Security Researcher

Stelle nicht auf LinkedIn

🕒 vor 7 Tagen

🌵 Arizona, California, +19 weitere Bundesländer – Remote

🌵 Arizona – Remote 🏄 California – Remote ⛰️ Colorado – Remote 🦌 Connecticut – Remote 🏛️ District of Columbia – Remote 🐊 Florida – Remote 🌽 Illinois – Remote 🌾 Nebraska – Remote 🏖️ New Jersey – Remote 🗽 New York – Remote 🌲 North Carolina – Remote 🌲 Oregon – Remote 🦀 Maryland – Remote 🍂 Massachusetts – Remote 🚗 Michigan – Remote 🏰 Missouri – Remote 🎸 Tennessee – Remote 🤠 Texas – Remote ⚔️ Virginia – Remote ☕ Washington – Remote 🧀 Wisconsin – Remote

💵 $190.000 - $319.000 / Jahr

⏰ Vollzeit

🟠 Senior

👮‍♂️ IT-Sicherheitsingenieur

Jetzt Bewerben

Ähnliche Remote-Jobs finden

E-Mail-Benachrichtigung für neue Jobs einrichten

📊 Überprüfen Sie Ihre Lebenslauf-Bewertung für diese Stelle

Verbessern Sie Ihre Chancen auf ein Vorstellungsgespräch, indem Sie Ihre Lebenslauf-Bewertung vor der Bewerbung überprüfen.

Lebenslauf hochladen

Semgrep

WebsiteLinkedInAlle Stellen

51 - 200 Mitarbeiter

Gegründet 2017

🔒 Cybersecurity

☁️ SaaS

Cybersecurity • SaaS

Semgrep ist ein Unternehmen für Anwendungssicherheit, das eine SaaS-AppSec-Plattform bereitstellt, die sich auf statische Anwendungssicherheitstests (SAST), Softwarezusammensetzungsanalyse (SCA) für Lieferkettenanfälligkeiten und Geheimnisentdeckung konzentriert. Es kombiniert schnelles, codebewusstes, regelbasiertes Scannen, Community- und verwaltete Regeln sowie KI-gestützte Triage- und Fixempfehlungen, um Fehlalarme zu reduzieren und Sicherheits-Feedback in Entwickler-Workflows und CI/CD-Pipelines zu integrieren. Die Produkte und die Engine von Semgrep sind darauf ausgelegt, Ingenieur- und Sicherheitsteams zu unterstützen, Sicherheit in Unternehmen zu automatisieren, zu skalieren und zu operationalisieren.

Beschreibung

• Build detection at scale. Design and ship security workflows that combine deterministic analysis (taint, reachability, static slicing) with LLM reasoning to find real vulnerabilities (SSRF, IDOR, injection, auth gaps, supply-chain risk, and beyond) across many languages and frameworks. • Make LLMs viable for security-critical work. Engineer agentic pipelines and prompts that are precise, cost-aware, and trustworthy: atomic, well-scoped steps grounded in deterministic context, with attention to hallucination, confidence calibration, and which models see sensitive code. • Push on hard problems in automated triage and validation. Help close the gap between 'a finding exists' and 'this finding is real and worth a developer’s time,' so we can run workflows broadly and validate results at scale rather than by weeks of manual review. • Build and defend quality with evals. Design benchmarks and evaluation loops grounded in real customer codebases, not just synthetic datasets, so we actually know when a workflow is good. • Encode security judgment into tooling. Model vulnerability classes, taint sources/sinks/sanitizers, and security properties as reusable, versioned logic that scales across ecosystems. • Learn new territory fast. Dive into unfamiliar languages, frameworks, and technologies, figure out how vulnerabilities manifest there, and turn that understanding into detection. • Prototype new products. Partner with Engineering and Product to conceive, prototype, and validate new capabilities, writing real (if not always production-grade) code, with a strong sense for the customer and the user. • Share your work. Publish blog posts, give talks, produce cheat sheets and workshops, and represent Semgrep’s research to the wider community. • Lead and plan research with impact. Set the direction for research based on industry trends, emerging threats, and where the field is heading, and turn that into work that moves our products and the broader security community forward.

🎯 Anforderungen

• Strong application security expertise: fundamental vulnerability classes, how they arise and manifest across languages and frameworks, and the ability to go deep into the details. • Experience finding vulnerabilities and explaining their impact and context to the developers responsible for fixing them (as a security researcher, consultant, security engineer). • Genuine fluency writing and auditing code in two or more languages, enough to build tools and prototypes, not just read code. • A builder’s mindset: you’d rather automate a problem than do it by hand, and you get satisfaction from tooling that scales your impact many times over. • Real curiosity about, or hands-on experience with, applied AI/LLMs (agentic workflows, prompt engineering, RAG, evals, or LLM tool use), and clear-eyed judgment about where models help and where they don’t. • Experience building or operating LLM/agent systems in production: pydantic-ai, MCP, multi-provider orchestration, eval frameworks, cost/latency awareness. • A strong desire to keep learning, and excitement (not reluctance) when handed an unfamiliar language, framework, or technology. • Comfort operating with autonomy: you can take an ambiguous problem, break it into milestones, drive it forward, and own the outcome without close oversight. • Enjoyment in sharing what you learn, through writing, talks, and teaching, inside and outside Semgrep.

🏖️ Vorteile

• Our compensation package includes equity and benefits in addition to salary. • We invest in our employees’ well-being and long-term success through a competitive, market-aligned benefits program that meets or exceeds local market standards across all of the regions in which we hire. • Benefits offerings vary by location to reflect local requirements and norms.