5 days ago
Stockholm, SwedenSenior
Responsibilities
- Develop proof-of-concepts for novel vulnerability detection techniques.
- Research attack vectors, vulnerability classes, security disclosures, and scalable sources of detection data.
- Design and build AI-agent workflows to uncover vulnerabilities and zero-days.
- Reverse engineer binaries to identify vulnerabilities and understand exploitation methods.
- Review detection code for accuracy and minimal false positives.
- Advise colleagues on security-related questions and tasks.
- Speak with customers about attack surfaces and security challenges and use those insights to guide research and development.
Requirements
- Hands-on experience finding and exploiting live vulnerabilities through avenues such as bug bounty programs, CVEs, CTFs, penetration testing, or published research.
- Deep knowledge of web application security and common vulnerability classes, including the OWASP Top 10 and beyond.
- Solid programming or scripting skills, such as Python or Go, and the ability to create working proof-of-concepts.
- Curiosity about or experience building with LLMs and AI agents for offensive security.
- Ability to explain technical findings clearly to engineers, customers, and non-security stakeholders.
- Active participation in the security community and understanding of how vulnerabilities work.
- Reverse-engineering experience is a bonus.
- Public vulnerability disclosures, technical blog posts, or security-conference talks are bonuses.
Benefits
- Hybrid work from the central Stockholm office, with an expectation of at least three office days per week.
- The company promotes an inclusive workplace and values diversity of experience, perspectives, and backgrounds.
- Candidates must already possess a valid work visa for Sweden; visa sponsorship and relocation assistance are unavailable.
About Detectify
Detectify builds a SaaS application-security platform for security and engineering teams to map external attack surfaces and identify exploitable web vulnerabilities using research from a vetted ethical-hacker community. Customers use its web scanner and attack surface management products to prioritize and remediate issues across web apps and cloud assets. Founded in 2013 and headquartered in Stockholm, it serves organizations worldwide across startups, enterprises, and public institutions.