{"id":3629397,"url":"https://alion.io/job/tuxcare-senior-security-research-engineer-securechain","title":"Senior Security Research Engineer (SecureChain)","company":{"id":1757662,"name":"TuxCare","domain":"tuxcare.com","url":"https://alion.io/company/tuxcare","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"AI/ML","role_family":"AI/ML","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Warsaw, Poland","Prague, Czech Republic","Bucharest, Romania","Tbilisi, Georgia","Podgorica, Montenegro","Madrid, Spain"],"countries":["PL","CZ","RO","GE","ME","ES"],"hiring_countries":["CZ","PL","RO","ES","GE"],"hiring_countries_total":5,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CVE","optional":false},{"name":"Linux","optional":false},{"name":"npm","optional":false},{"name":"Python","optional":false},{"name":"JavaScript","optional":true}],"status":"live","first_seen_at":"2026-10-27T00:00:00Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-11-10T06:16:51Z","board_verified":true,"closed_at":null,"days_open":14,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":14},"description":"TuxCare provides security solutions for Linux and open-source software used by enterprise organizations. Our products help companies automate vulnerability patching, reduce downtime, maintain security and compliance, and support critical systems throughout their lifecycle.\nLearn more about TuxCare: tuxcare.com\nWe are looking for a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain.\nSecureChain is TuxCare's open-source software supply chain security product. It provides packages rebuilt from verified source code, scanned for malware and supply chain risks.\nLearn more: tuxcare.com/securechain-for-oss\nThe Mission\nYou will be the first engineer of a new function, with a plan to grow it to three or four people. You are a security researcher first, and you build production-quality tools and pipelines to scale your research.\nThe function has three goals:\nDetect malicious code before SecureChain publishes a package.\nBuild pipelines that find and help fix high and critical vulnerabilities in maintained and end-of-life open-source software.\nPublish useful, evidence-backed security research after coordinated disclosure.\nYou will be responsible for:\nOwning SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.\nExtending detection with artifact scanning, static signals, dynamic analysis and external intelligence.\nBuilding repeatable pipelines that discover new vulnerabilities in software that SecureChain and ELS support, with priority on high/critical risks and on EOL versions customers still use.\nReproducing findings, proving impact and reachability, and storing evidence so another researcher can repeat the result.\nDeveloping AI-assisted methods to generate and test candidate fixes, and feeding them into our patch automation.\nOwning TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.\nPreparing technical write-ups and research publications together with Marketing.\nYour first 90 days:\nDays 1-30: take over the malicious-code detector, its sample review and CNA responsibilities; inventory services, data, prompts, corpus and open work.\nDays 31-60: improve the detector and its review workflow, measure alert volume, false positives and cost; start a vulnerability-discovery pilot on 5-10 packages of one ecosystem.\nDays 61-90: expand discovery across the ecosystem, complete coordinated disclosure where applicable, publish the first research output.\nRequirements\nMust-haves:\nSecurity research background: malware or software supply-chain research, vulnerability discovery and root-cause analysis.\nStrong Python or another suitable systems language; you build tools and pipelines that run in production.\nCI pipelines, test automation and operating services.\nPractical use of static analysis, fuzzing and sandboxing.\nHeavy, daily use of AI-assisted tools in research and engineering.\nExperience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).\nClear research reports and experience with coordinated disclosure.\nAdvanced written and spoken English.\nNice-to-haves:\nPublished CVEs, advisories or security research.\nExperience with CNA operations or vulnerability databases (CVE, OSV).\nThis is not a SOC analyst, compliance, penetration testing or general software development role.\nBenefits\nWhat's in it for you?\nA focus on professional development.\nInteresting and challenging projects.\nFully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.\nPaid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.\nCompensation for private medical insurance.\nCo-working and gym/sports reimbursement.\nBudget for education.\nThe opportunity to receive a reward for the most innovative idea that the company can patent.\nBy applying for this position, you consent to the processing of your personal data as described in our Privacy Policy (https://tuxcare.com/privacy-policies-hub/candidate-privacy-notice/ ), which provides detailed information on how we maintain and handle your data.","description_format":"text","description_chars":4219,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Flexible schedule","Health insurance","Professional development"],"hiring_locations":[{"name":"Czech Republic","iso":"CZ","kind":"country"},{"name":"Poland","iso":"PL","kind":"country"},{"name":"Romania","iso":"RO","kind":"country"},{"name":"Spain","iso":"ES","kind":"country"},{"name":"Georgia","iso":"GE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-11-02T20:27:33Z"}],"visa":[],"liveness":{"score":77,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.852,"p_room":0.9,"age_days":13,"expected_fill_days":30,"reasons":["conf:1","velocity","win:mid"],"computed_at":"2026-11-09T06:03:00Z"},"pay":null,"html_url":"https://alion.io/job/tuxcare-senior-security-research-engineer-securechain","json_url":"https://alion.io/job/tuxcare-senior-security-research-engineer-securechain.json","meta":{"generated_at":"2026-11-10T06:35:44Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15370,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1757662},"rest":"https://alion.io/mcp/rest/get_company?id=1757662"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftuxcare-senior-security-research-engineer-securechain"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftuxcare-senior-security-research-engineer-securechain"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftuxcare-senior-security-research-engineer-securechain"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tuxcare-senior-security-research-engineer-securechain\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftuxcare-senior-security-research-engineer-securechain"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3629397}},{"tool":"search_jobs","arguments":{"company":"tuxcare.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3629397},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}