Security Researcher; Europe Remote

Location: Open to candidates residing anywhere in Europe, time zones (CET ± 2 hours)

Delivering the industry’s most accurate application security platform, Invicti Security has been transforming the way web applications are secured for nearly 20 years. Recognized as a leader in Application Security Testing and a DAST Innovator by Latio, Invicti enables organizations to continuously scan and secure their web apps and APIs with the rigor of runtime testing and the speed of constant innovation.

Headquartered in Austin, Texas, Invicti serves more than 3,600 organizations worldwide. Invicti serves more than 3,600 organizations worldwide. To learn more, visit  or follow us on Linked In.

You are a hands-on offensive security researcher who enjoys turning vulnerability and malware knowledge into detection content that ships. You take ownership of the security checks you build, write clean and accurate detection rules, and care deeply about quality and low false-positive rates. You have strong opinions that are loosely held, apply established research principles in your day-to-day work, and help ensure our security checks deliver solid results for our customer base.

• Create new detection rules (primarily Open Grep) to catch novel malware and vulnerability patterns and boost detection accuracy.
• Extend support for new programming languages across our analysis pipeline.
• Explore and experiment with cutting-edge tools and techniques to detect threats and malware at scale.
• Research novel ways to exploit and analyze modern web applications and APIs — building proof-of-concept attacks and translating findings into shippable capabilities.
• Research new vulnerability classes, exploitation techniques, cloud-native attack paths, and AI-specific attack vectors, and convert research into production-ready detections.
• Direct the application of existing detection and exploitation principles while contributing to new policies, research standards, and attack methodologies.
• Build attack chain templates that combine low-severity findings into high-impact exploitation paths.
• Contribute to evaluation harnesses and benchmarks that measure detection effectiveness — false-positive rates, coverage, and accuracy.
• Design and maintain evaluation harnesses, testing frameworks, and benchmarking systems that continuously measure detection accuracy, exploit reproducibility, false-positive rates, and coverage.
• Contribute to internal research and help shape our public research agenda.
• Write and publish blog posts on novel attacks and large-scale incidents, and represent Invicti in the security community through CVEs, tool releases, and conference contributions.
• Stay current on industry trends in App Sec, AI red-teaming, offensive AI, LLM vulnerabilities, agent security, MCP security, and cloud-native attack techniques, and translate those insights into research priorities and product capabilities.
• Triage packages from our analysis pipeline and validate findings.

• Mentor junior and mid-level researchers on detection writing and exploitation technique.
• Collaborate across engineering, product, AI/ML, and infrastructure teams to ensure research output ships and stays operational.
• Partner with platform and infrastructure teams to improve security automation across CI/CD pipelines and cloud-native environments.
• Help maintain detection quality across the platform, including triaging difficult or ambiguous findings.

• 8+ years of offensive security or application security research experience (Bachelor's + 5 years, or Master's + 3 years).
• Broad knowledge of programming languages — JavaScript is a must, Python is a huge plus.
• Strong understanding of security principles, standards, and best practices.
• D…