Sr Security Researcher
Endor Labs4 months ago
Responsibilities
- Discover and evaluate vulnerabilities in first- and third-party software components, with a focus on application security.
- Detect zero-day vulnerabilities in open-source projects and develop exploit code and proofs of concept for known vulnerabilities.
- Evaluate and compare security tools, detect malicious open-source components, and configure and operate SAST or DAST tools.
- Oversee and potentially extend the vulnerability database and ingestion process to ensure accurate, timely advisories.
- Present novel research at security conferences and contribute to blogs, technical reports, and whitepapers.
Requirements
- Bachelor’s degree in engineering and at least 5 years of application security experience.
- Programming experience with Go, Java, JavaScript, and Python.
- Understanding of software weaknesses and vulnerabilities.
- Experience configuring and operating security tooling such as SCA and SAST.
- Understanding of industry standards including CVE and EPSS.
- Experience developing security tools or SAST rules is preferred.
- Knowledge of software supply chains and their attack surface is preferred.
- Publicly reported zero-day vulnerabilities are preferred.
- Experience in malware detection and analysis is preferred.
- Security certifications such as OSCP or CEH are preferred.
Tech Stack
Categories
About Endor Labs
Endor Labs is the AppSec platform built for the AI era. It helps teams find, prioritize, and fix the most critical risks in code, whether written by humans or AI—faster. Endor Labs understands the entire structure of your codebase, from 40 year-old C++ to modern Bazel monorepos. Powered by AI agents and the industry's richest security dataset about open source code, Endor Labs doesn’t just flag issues, it reduces noise, prioritizes what matters most, and proposes intelligent remediations based on the context of your code. Whether you’re an upstart or in the Fortune 500, Endor Labs helps AppSec and development teams eliminate noisy alerts, fix code 6.2x faster, and stay compliant with standards like FedRAMP, PCI, SLSA, and NIST SSDF.