Lead Security Research Engineer

About Innodata

Innodata builds training and evaluation data for the world's leading AI companies. Our cybersecurity research practice works at the intersection of security and AI.

About the Role

We are looking for a hands-on Lead Security Research Engineer to lead applied cybersecurity research across web applications, cloud infrastructure, and systems.

The ideal candidate is an experienced security researcher who can discover complex vulnerabilities that automated scanners often miss, validate exploitability, guide technical research, and maintain a high quality bar for security findings and remediation.

Key Responsibilities

• Lead hands-on vulnerability research across web applications, APIs, cloud infrastructure, and systems.
• Discover and investigate complex security vulnerabilities that conventional static analysis and automated scanners may miss.
• Perform manual security testing, source-code analysis, exploit validation, and root-cause analysis.
• Investigate vulnerabilities arising from application logic, authorization, infrastructure configuration, and interactions between code and configuration.
• Review research findings for exploit validity, assess false positives, and verify that fixes resolve vulnerabilities without breaking intended functionality.
• Define research methodologies, technical specifications, reproducible test cases, and testable security and functional acceptance criteria.
• Mentor security research engineers and review their technical work.
• Collaborate with AI researchers and client engineering teams to translate requirements into rigorous security evaluations.

Must-Have Qualifications

• 8+ years of experience across software engineering and cybersecurity, including Application Security, Offensive Security, Penetration Testing, Product Security, or Vulnerability Research.
• Demonstrated hands-on experience discovering and validating complex vulnerabilities that automated security tools may miss.
• Strong understanding of application security, source-code review, authentication and authorization, business logic vulnerabilities, and exploitability assessment.
• Practical cloud security experience in at least one of AWS, GCP, or Azure, along with hands-on Kubernetes security knowledge.
• Understanding of cloud IAM, excessive permissions, network policies, secrets management, infrastructure as code, and cloud misconfigurations.
• Experience with vulnerability reproduction, root-cause analysis, false-positive assessment, remediation verification, and technical security reporting.
• Ability to review other researchers findings, provide technical guidance, mentor engineers, and define clear research specifications.
• Strong technical writing and communication skills.

Nice-to-Have Qualifications

• Public CVEs, bug bounty achievements, responsible vulnerability disclosures, security advisories, or published security research.
• Experience with fuzzing, AI-assisted vulnerability discovery, security automation, or exploit development.
• Experience with AI coding assistants, AI agents, LLM security, or building security evaluations for AI systems.
• Research experience in memory-safety vulnerabilities, race conditions, or concurrency bugs.
• Relevant open-source security contributions or demonstrable independent security research.

Engagement Details

• Work arrangement: Remote
• Engagement model: Initial consulting/freelance contract, with a potential path to full-time employment
• Role level: Senior / Lead individual contributor with technical leadership responsibilities

Candidates should be comfortable with an initial consulting engagement and demonstrate a strong hands-on approach to security research.

Interested candidates: Please share CV at [HIDDEN TEXT] , highlighting relevant vulnerability research, application security, cloud/Kubernetes security, and technical leadership experience.