{"id":924904,"url":"https://alion.io/job/invicti-staff-security-researcher-2","title":"Staff Security Researcher","company":{"id":681169,"name":"Invicti","domain":"invicti.com","url":"https://alion.io/company/invicti","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Birkirkara, Malta"],"countries":["MT"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":52000,"max_usd":126000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":724},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Invicti","optional":false},{"name":"JavaScript","optional":false},{"name":"LLM","optional":false},{"name":"LLM Evaluation","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"AI Agents","optional":true},{"name":"Burp Suite","optional":true},{"name":"GraphQL","optional":true},{"name":"Kubernetes","optional":true},{"name":"Nmap","optional":true},{"name":"OWASP Top 10","optional":true},{"name":"Rest API","optional":true},{"name":"Semgrep","optional":true},{"name":"SQLmap","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-09-14T00:00:00Z","employer_posted_date":"2026-09-14","last_verified_at":"2026-11-03T05:33:28Z","board_verified":true,"closed_at":null,"days_open":50,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":50},"description":"Who we are:\nDelivering the industry’s most accurate application security platform, Invicti Security has been transforming the way web applications are secured for nearly 20 years. Recognized as aleader in Application Security Testing and a DAST Innovator by Latio, Invicti enables organizations to continuously scan and secure their web apps and APIs with the rigor of runtime testing and the speed of constant innovation. Headquartered in Austin, Texas, Invicti serves more than 3,600 organizations worldwide. Invicti serves more than 3,600 organizations worldwide. To learn more, visitInvicti.com or follow us onLinkedIn.\nWho You Are:\nYou are a hands-on offensive security researcher who enjoys turning vulnerability and malware knowledge into detection content that ships. You take ownership of the security checks you build, write clean and accurate detection rules, and care deeply about quality and low false-positive rates. You have strong opinions that are loosely held, apply established research principles in your day-to-day work, and help ensure our security checks deliver solid results for our customer base.\nRequirements\nLocation:Candidates need to be based in Malta \nWhat You'll Be Doing:\nCreate new detection rules (primarily OpenGrep) to catch novel malware and vulnerability patterns and boost detection accuracy.\nExtend support for new programming languages across our analysis pipeline.\nExplore and experiment with cutting-edge tools and techniques to detect threats and malware at scale.\nResearch novel ways to exploit and analyze modern web applications and APIs - building proof-of-concept attacks and translating findings into shippable capabilities.\nResearch new vulnerability classes, exploitation techniques, cloud-native attack paths, and AI-specific attack vectors, and convert research into production-ready detections.\nDirect the application of existing detection and exploitation principles while contributing to new policies, research standards, and attack methodologies.\nBuild attack chain templates that combine low-severity findings into high-impact exploitation paths.\nContribute to evaluation harnesses and benchmarks that measure detection effectiveness - false-positive rates, coverage, and accuracy.\nDesign and maintain evaluation harnesses, testing frameworks, and benchmarking systems that continuously measure detection accuracy, exploit reproducibility, false-positive rates, and coverage.\nContribute to internal research and help shape our public research agenda.\nWrite and publish blog posts on novel attacks and large-scale incidents, and represent Invicti in the security community through CVEs, tool releases, and conference contributions.\nStay current on industry trends in AppSec, AI red-teaming, offensive AI, LLM vulnerabilities, agent security, MCP security, and cloud-native attack techniques, and translate those insights into research priorities and product capabilities.\nTriage packages from our analysis pipeline and validate findings.\nMentor junior and mid-level researchers on detection writing and exploitation technique.\nCollaborate across engineering, product, AI/ML, and infrastructure teams to ensure research output ships and stays operational.\nPartner with platform and infrastructure teams to improve security automation across CI/CD pipelines and cloud-native environments.\nHelp maintain detection quality across the platform, including triaging difficult or ambiguous findings.\nWhat You'll Need:\n8+ years of offensive security or application security research experience (Bachelor's + 5 years, or Master's + 3 years).\nBroad knowledge of programming languages - JavaScript is a must, Python is a huge plus.\nStrong understanding of security principles, standards, and best practices.\nDeep understanding of vulnerability classifications, exploitation methodologies, and secure software development practices.\nComplete knowledge and full understanding of detection writing for DAST scanners, fuzzers, or comparable systems - including detection logic, response interpretation, and false-positive management.\nExperience designing testing frameworks, evaluation harnesses, or large-scale validation systems for security tooling.\nDeep web application pentesting experience covering the OWASP Top 10 and adjacent classes - authentication, authorization, business logic, modern API surfaces (REST, GraphQL).\nComfortable researching and tackling hard problems and algorithms (e.g., parsing with ASTs).\nFluency with offensive tooling (Burp Suite, sqlmap, nmap, ffuf, custom payload generation) and the underlying HTTP/web protocol fundamentals.\nExperience with cloud platforms, Kubernetes, containers, infrastructure-as-code, and CI/CD security is highly desirable.\nPractical experience researching or securing LLM-powered applications, AI agents, or AI-assisted development workflows, including prompt injection, model abuse, tool invocation risks, MCP security, and emerging AI attack techniques.\nFluent in English, with strong written and verbal communication skills and the ability to convey technical details to both technical and non-technical audiences.\nAbility to collaborate effectively across multi-disciplinary teams and exercise judgment on when to escalate issues.\nA hands-on attitude, intellectual curiosity, and willingness to research across traditional application security, cloud-native security, and the rapidly evolving AI ecosystem, including LLM vulnerabilities, agent security, and MCP security.\nBonus Points:\nOpenGrep (or Semgrep) experience.\nStatic analysis experience.\nExperience building production-ready systems.\nPublic security research output (CVEs, advisories, talks, open-source tools).\nYARA experience.\nBenefits\nWhy Invicti:\nYour Health & Wellness Matters:\nHealth Insurance : Taking care of our team goes beyond the office. We cover 100% of employee health care and dental premium costs. For dependents, we contribute 100% of the health care and 50% dental premium cost\nVDU testing: Upon joining us, we will provide for free a one time Visual Display Unit testing to ensure you can work as comfortable as possible\nEmployee Assistance Program: Emotional Support Counseling services 24/7. Life Coaching, Dependent Care, Elder Care, Financial & Legal Support, Wellness Coaching, New Parent Support and more\nFamily Leave: 16 week paid leave for birthing parent recovery. 4 week paid leave for non-birthing/bonding parent\nWe value Adult/ Life Balance:\nExcellent working Options: Our teams operate in a hybrid office/home schedule\nQuarterly Thrive-Wellness Days: One extra vacation day per quarter where the entire company takes a break from normal, daily activities to refresh and rejuvenate\nVolunteerism Time Off: 5 days of paid time off each year to participate in the volunteer activities of your choice\nPaid Birthday Off: Take your birthday off to celebrate you!\nMobile Allowance Benefit: This allowance will be provided to ensure you have support for work-related communication and tasks\n We Value You:\nEmployee Recognition: Ongoing recognition & rewards . A Culture that emphasizes personal and professional growth\nAt Invicti, we believe our people are at the core of our success. Our Total Rewards approach is designed to attract, support, and grow exceptional talent by offering a balanced mix of competitive compensation, meaningful benefits, and opportunities for recognition and development. We take a global, flexible approach that aligns with our business goals and values while adapting to regional needs. Above all, we are committed to transparency and ensuring our employees understand how we invest in their success and well-being.\nAs we operate in a dynamic, fast-paced industry, this role evolves with the business. While core responsibilities are outlined above, duties may adapt over time to meet operational needs and support both team success and your professional growth\n\"At Invicti, we embrace diversity and individuality in all forms. Discrimination has no place here - regardless of race, religion, gender, age, ability, sexual orientation, or any other aspect that makes you unique. We're all about creating a space where everyone","description_format":"text","description_chars":8148,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Health insurance","Parental leave"],"hiring_locations":[{"name":"Malta","iso":"MT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Software","Application Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-09-15T05:48:25Z"}],"visa":[],"liveness":{"score":44,"band":"fade","label":"Fading","p_open":1,"p_active":0.794,"p_room":0.55,"age_days":50,"expected_fill_days":49,"reasons":["conf:0","win:tail"],"computed_at":"2026-11-03T05:54:40Z"},"pay":null,"html_url":"https://alion.io/job/invicti-staff-security-researcher-2","json_url":"https://alion.io/job/invicti-staff-security-researcher-2.json","meta":{"generated_at":"2026-11-03T09:39:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13616,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":681169},"rest":"https://alion.io/mcp/rest/get_company?id=681169"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Finvicti-staff-security-researcher-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Finvicti-staff-security-researcher-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Finvicti-staff-security-researcher-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/invicti-staff-security-researcher-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Finvicti-staff-security-researcher-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":924904}},{"tool":"search_jobs","arguments":{"company":"invicti.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":924904},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}