JobCubby JobCubby
Sign up
CommIT

Senior Application Security Researcher

CommIT Barcelona, Catalonia, Spain

Software Development · 501-1,000 employees

10 h ago
security Senior (5-10 yrs) Full-time Spain
Create a free account to apply — email only, no card. You can also save this posting or score it against your profile with AI.

Applying here? Try the free cover letter tool — paste this posting and your résumé, no account needed.

About the role

The researcher will work with engineers and AI scientists to develop next-generation detection capabilities, including autonomous agentic pen-testing. They are responsible for taking research ideas from prototype to production while securing AI-driven SDLC processes.

What they look for

Offensive security Vulnerability research Application security Python Go SAST DAST SCA CI/CD Kubernetes Cloud computing LLMs AI models SQL BigQuery Penetration testing

Requirements

Candidates must have 5+ years of experience in offensive security or application security with strong coding skills in Python or Go. A postgraduate degree in Computer Science or a related field is required, along with expertise in modern stacks and AI security tasks.

Full description

The company secures the AI-driven SDLC from prompt to production, unifying development and cloud context to stop vulnerabilities at the source. The Security Research group is hiring a senior, hands-on Application Security Researcher to push modern AppSec forward — working with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is a build-and-break role, not a typical AppSec position.

Requirements

Must-have skills:

  • 5+ years hands-on in offensive security, vulnerability research, or application security
  • Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains
  • Strong coding in Python, Go, or similar, with production-quality code shipped
  • **Experience building or tuning detection logic (**SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives
  • Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider
  • Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail
  • Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy
  • Takes research ideas from prototype to production with minimal guidance
  • Clear written communication — can explain a complex attack path to engineers and product managers
  • M.Sc. in Computer Science, Cyber Security, or a related field

Nice to have:

  • Published research, CVEs, conference talks, or a bug bounty track record
  • Experience building AI agents or evaluation frameworks for LLMs
  • Background in exploit development, red teaming, or penetration testing
  • Code analysis techniques (taint analysis, call graphs, reachability)
  • Contributions to open-source security tools

Similar roles