应用安全研究员
Application Security Researcher
OX Security 从提示到生产，保障 AI 驱动的 SDLC 安全。我们通过云运行时消除 AI 代码生成中的关键实时风险，做到传统工具无法做到的事：将开发和云上下文统一，从源头阻止漏洞。在 OX，我们正在为 AI 时代构建网络安全的未来。如果你希望与一支优秀的团队一起从事颠覆性技术，你就在正确的地方。
我们正在寻找一位技能娴熟的应用安全研究员加入我们的安全研究团队，帮助我们推动现代应用安全的边界。这是一个关键且需要亲力亲为的职位，你将与工程师、研究人员以及 AI 和数据科学家紧密合作，打造下一代应用安全——包括自主、代理式的渗透测试能力。
这不是一个典型的应用安全职位。你将负责构建、破坏并重新定义大规模进攻性安全的工作方式。
职责
你将从事的工作
- 研究跨应用程序和基础设施的漏洞链、业务逻辑缺陷和复杂攻击路径
- 设计并构建自主安全系统的检测引擎和决策逻辑
- 评估 AI 模型在应用安全用例中的表现，衡量其优势和不足
- 原型设计、构建并部署安全功能到生产环境
- 分析大规模安全数据，发现可利用的攻击路径并提高检测准确性
- 与产品、工程和数据团队合作，塑造下一代安全功能
- 帮助确定团队的研究方向，并从想法到实际功能全程负责自己的项目
要求
你将带来的条件
- 计算机科学、网络安全或相关领域的硕士及以上学历
- 5年以上在进攻性安全、漏洞研究或应用安全方面的实战经验
- 对 Web 应用和 API 漏洞有深入理解，包括业务逻辑缺陷和多步骤攻击链
- 具备 Python、Go 或类似语言的强编码能力，并有部署生产级代码的经验
- 有构建或优化检测逻辑（SAST、DAST、SCA、密钥或自定义规则引擎）的经验，并能减少误报
- 熟悉现代应用和基础设施栈：CI/CD 流水线、容器、Kubernetes，以及至少一个主要云服务商
- 有使用 LLM 或 AI 模型进行安全任务的实际经验
查看英文原文
Description
About the Position
OX Security secures the AI-driven SDLC from prompt to production. We eliminate critical, real-time risks from AI code generation through cloud runtime by doing what conventional tools can’t: unifying development and cloud context to stop vulnerabilities right at the source. At OX, we’re building the future of cyber security for the AI era. If you’re looking to work on disruptive technology with an amazing team, you belong here.
We’re looking for a highly skilled Application Security Researcher to join our Security Research group and help us push the boundaries of modern AppSec. This is a critical, hands-on role where you’ll work closely with engineers, researchers, and AI & data scientists to build the next generation of application security - including autonomous, agentic pen testing capabilities.
This is not a typical AppSec role. You’ll be building, breaking, and redefining how offensive security works at scale.
Responsibilities
What You’ll Be Doing
- Research vulnerability chaining, business-logic flaws, and complex attack paths across applications and infrastructure
- Design and build detection engines and decision-making logic for autonomous security systems
- Evaluate AI models for application security use cases, measuring where they perform and where they fall short
- Prototype, build, and ship security capabilities into production environments
- Analyze large-scale security data to uncover exploitable attack paths and improve detection accuracy
- Partner with Product, Engineering, and Data teams to shape the next generation of security features
- Help set the team's research direction and own initiatives end to end, from idea to shipped capability
Requirements
What You'll Bring
- M.Sc. in Computer Science, Cyber Security, or a related field
- 5+ years of hands-on experience in offensive security, vulnerability research, or application security
- Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains
- Strong coding skills in Python, Go, or a similar language, with experience shipping production-quality code
- Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives
- Solid grasp of modern application and infrastructure stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider
- Hands-on experience using LLMs or AI models for security tasks, and the judgment to measure where they help and where they fail
- Comfort working with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy
- Ability to take a research idea from prototype to production with minimal guidance
- Clear written communication: you can explain a complex attack path to engineers and product managers
Nice to Have
- Published research, CVEs, conference talks, or bug bounty track record
- Experience building AI agents or evaluation frameworks for LLMs
- Background in exploit development, red teaming, or penetration testing
- Experience with code analysis techniques (taint analysis, call graphs, reachability)
- Contributions to open-source security tools
Benefits Package (via Vensure)
We partner with Vensure to provide top-tier benefits for our Canada-based team members:
- Comprehensive Health Coverage: Medical, Dental, and Vision plans to keep you and your family healthy.
- Unlimited Paid Time Off (PTO): We offer unlimited vacation because we trust you to take time when you need it and to manage your time effectively. We value work-life balance and want you to recharge.
- Gifts on your birthday & anniversary, & Holidays.
Originally posted on Himalayas