{"id":3397601,"url":"https://alion.io/job/qualys-senior-security-research-engineer-5","title":"Senior Security Research Engineer","company":{"id":18966,"name":"Qualys","domain":"qualys.com","url":"https://alion.io/company/qualys","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":95,"open_postings":4,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":63,"computed_at":"2026-10-29T05:49:05Z"}},"role":"AI/ML","role_family":"AI/ML","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pune, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":22000,"max_usd":46000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":41},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Binary Ninja","optional":false},{"name":"C++","optional":false},{"name":"Claude Code","optional":false},{"name":"Defense in Depth","optional":false},{"name":"Ghidra","optional":false},{"name":"LLM","optional":false},{"name":"pwndbg","optional":false},{"name":"pwntools","optional":false},{"name":"Python","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"Rust","optional":false},{"name":"WinDbg","optional":false},{"name":"Assembly","optional":true},{"name":"CVE","optional":true}],"status":"live","first_seen_at":"2026-08-24T00:00:00Z","employer_posted_date":"2026-08-24","last_verified_at":"2026-10-29T05:19:25Z","board_verified":true,"closed_at":null,"days_open":66,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":66},"description":"Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!\nWe're hiring a vulnerability researcher for the Threat Research Unit at Qualys. You'll take vulnerabilities apart to understand exactly how they work, prove out what an attacker could do with them, and turn that into detections and mitigations that hold up on real customer systems. The work sits between offense and defense: writing proof-of-concept exploits to ground your analysis in fact, then using what you learn to build safe, reliable checks and design defenses that make whole classes of bugs harder to exploit.\n Responsibilities:\nAnalyze vulnerabilities down to the affected code path, trigger conditions, the primitive they yield, and what a patch actually changes.\nDevelop proof-of-concept exploits in the lab to establish reachability, reliability, and real-world impact, giving detection and mitigation work a concrete basis in what an attacker can achieve.\nBuild non-harmful checks that confirm whether a vulnerability is present on customer hosts. Use a distinguishing signal instead of a harmful payload, and deliver a clear verdict, a response taxonomy, a safety statement, and a false-positive analysis.\nAssess mitigation bypasses. Given a vulnerability and a target's defenses (ASLR, DEP/NX, stack canaries, CFI, RELRO, sandboxing, and modern hardware mitigations), determine whether exploitation remains feasible and how.\nDesign and write stronger mitigations at two levels: killing bug classes and patching individual instances. This includes compiler and platform hardening, defense-in-depth, and design changes that make exploitation economically infeasible even when a bug survives.\nRead and adapt public offensive and detection tooling, with a clear grasp of which parts are detection, which are payload, and which are load-bearing for a bypass.\nStand up matched vulnerable and patched lab environments for reproducible exploitation, regression testing, and mitigation validation.\nRequired Qualifications:\nMinimum 3 year of experience in Vulnerability research.\nBE/B.Tech/MCA, preferably in Computer Science, Information Technology, or a related field.\nNative and binary exploitation. Practical command of memory-corruption classes: stack and heap overflows, use-after-free, double-free, type confusion, integer overflows, off-by-one, and format-string bugs. Comfortable with a debugger and disassembler/decompiler workflow (gdb with pwndbg or GEF, WinDbg, IDA, Ghidra, or Binary Ninja) and with pwntools or an equivalent.\nVulnerability-class fluency. Able to reason in terms of root-cause classes and run variant analysis.\nScripting and delivery. Proficient in at least one of Python, C/C++, Go, or Rust.\nClear technical writing. Able to document exploitation reasoning, verdict logic, residual risk, and known gaps, including an honest record of what you tried, where a constraint blocked the ideal approach, and what you shipped instead.\nWorking fluency with AI and LLM tools (such as Claude Code) as part of your day-to-day workflow.\nPreferred Qualifications:\nPublished CVE research, exploit development, or coordinated disclosure.\nFuzzing experience.\nProgram analysis experience.\nReverse engineering or source-code review to pinpoint a patch's distinguishing change.\nAuthoring experience for a detection or scanning platform.\nCTF background or an equivalent hands-on track record.\nReproducible lab orchestration (containers or VMs) for exploitation and mitigation fixtures.","description_format":"text","description_chars":3521,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","Security Compliance","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-10-28T13:08:18Z"}],"visa":[],"liveness":{"score":21,"band":"cold","label":"Long shot","p_open":1,"p_active":0.485,"p_room":0.44,"age_days":66,"expected_fill_days":63,"reasons":["conf:0","evergreen","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/qualys-senior-security-research-engineer-5","json_url":"https://alion.io/job/qualys-senior-security-research-engineer-5.json","meta":{"generated_at":"2026-10-29T13:10:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19739,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":18966},"rest":"https://alion.io/mcp/rest/get_company?id=18966"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fqualys-senior-security-research-engineer-5"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fqualys-senior-security-research-engineer-5"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fqualys-senior-security-research-engineer-5"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/qualys-senior-security-research-engineer-5\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fqualys-senior-security-research-engineer-5"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3397601}},{"tool":"search_jobs","arguments":{"company":"qualys.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3397601},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}