Senior Application Security Researcher

Lead research and development of application security solutions, focusing on AI-driven detection and autonomous penetration testing.

Ukraine
Posted Nov 9, 2026

INDUSTRYSoftware & InternetCybersecurity

Apply with RefersoAI Apply on careers page

Responsibilities

Conduct offensive security research and vulnerability analysis
Develop and tune detection logic for SAST, DAST, SCA, and custom rule engines
Integrate security solutions into CI/CD pipelines and cloud environments
Apply LLMs and AI models to enhance security workflows
Translate research findings into production-ready tools
Communicate complex attack paths to engineering and product teams

Requirements

M.Sc. in Computer Science
M.Sc. in Cyber Security
Experience in a Cybersecurity

Nice to have: published research, CVEs, conference talks, bug bounty track record, AI agents, LLM evaluation frameworks, exploit development, red teaming, penetration testing, taint analysis, call graphs, reachability, open-source security tools

Skills

offensive securityvulnerability researchapplication securityweb application vulnerabilitiesAPI vulnerabilitiesbusiness-logic flawsmulti-step attack chainsPython GoSASTDASTSCAcontainersKubernetescloud providerSQL BigQuery Python GoSASTDASTSCAcontainersKubernetescloud providerSQL BigQuery

Full description

Description The company secures the AI-driven SDLC from prompt to production, unifying development and cloud context to stop vulnerabilities at the source. The Security Research group is hiring a senior, hands-on Application Security Researcher to push modern AppSec forward — working with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is a build-and-break role, not a typical AppSec position. Requirements Must-have skills: 5+ years hands-on in offensive security, vulnerability research, or application security Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains Strong coding in Python, Go, or similar, with production-quality code shipped **Experience building or tuning detection logic (**SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy Takes research ideas from prototype to production with minimal guidance Clear written communication — can explain a complex attack path to engineers and product managers M.Sc. in Computer Science, Cyber Security, or a related field Nice to have: Published research, CVEs, conference talks, or a bug bounty track record Experience building AI agents or evaluation frameworks for LLMs Background in exploit development, red teaming, or penetration testing Code analysis techniques (taint analysis, call graphs, reachability) Contributions to open-source security tools