Senior Security Researcher
Endor Labs2 days ago
Responsibilities
- Conduct offensive security research on software supply chain threats and identify zero-day vulnerabilities.
- Develop exploit techniques for attack vectors involving malicious code, third-party libraries, and CI/CD systems.
- Translate research findings into security capabilities in collaboration with Product Management.
- Publish research through technical blogs, white papers, and security conferences.
- Collaborate with security engineers and developers to prototype detection and mitigation strategies.
- Develop open-source tools, methodologies, or frameworks that improve software supply chain security.
- Monitor emerging threats, attacker methodologies, and security trends.
Requirements
- 5+ years of experience in security research, vulnerability discovery, and offensive security.
- Deep expertise in reverse engineering, exploit development, and software vulnerability analysis.
- Strong understanding of software supply chain security, package management systems, CI/CD pipelines, and dependency analysis.
- Experience discovering and responsibly disclosing zero-day vulnerabilities.
- Proven record of publishing high-quality research or presenting at conferences such as Black Hat, DEF CON, RSAC, or BSides.
- Proficiency in Python, Rust, or Go.
- Strong analytical skills and ability to conduct complex research autonomously.
- Excellent written and verbal communication skills.
Benefits
- Opportunity to work at the intersection of developer productivity and security on software supply chain protection.
- Opportunity to influence security research and product capabilities with a world-class team.
- Equal Opportunity Employer committed to diversity and inclusion.
About Endor Labs
Endor Labs builds an application security platform that maps code and dependencies to prioritize and remediate risks across the SDLC for AppSec and engineering teams. It supports SCA, SAST, container scanning, and software supply chain controls, including code produced by humans or AI. Founded in 2021 and headquartered in Palo Alto, it is privately held and sells to enterprises through multi-stakeholder security and engineering buyers.