JobCubby JobCubby
Sign up
CommIT

Senior Application Security Researcher

CommIT Yerevan, Armenia

Software Development · 501-1,000 employees

4 d ago
security Senior (5-10 yrs) Full-time Armenia
Create a free account to apply — email only, no card. You can also save this posting or score it against your profile with AI.

Applying here? Try the free cover letter tool — paste this posting and your résumé, no account needed.

About the role

Research and develop next-generation application security detection, including autonomous agentic penetration-testing capabilities, in collaboration with engineers, researchers, and AI/data scientists. Take research from prototype to production, improve detection accuracy, and communicate complex attack paths to technical and product teams.

What they look for

Offensive Security Vulnerability Research Application Security Web Application Security API Security Python Go Detection Engineering SAST DAST Software Composition Analysis LLM Security SQL Cloud Security Kubernetes CI/CD

Requirements

Requires at least five years of hands-on offensive security, vulnerability research, or application security experience, strong coding skills, and deep knowledge of web and API vulnerabilities and attack chains. Candidates should have experience building detection logic, working with modern cloud and CI/CD environments, applying LLMs to security tasks, analyzing large datasets, and hold an M.Sc. in a related field.

Full description

The company secures the AI-driven SDLC from prompt to production, unifying development and cloud context to stop vulnerabilities at the source. The Security Research group is hiring a senior, hands-on Application Security Researcher to push modern AppSec forward — working with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is a build-and-break role, not a typical AppSec position.

Requirements

Must-have skills:

  • 5+ years hands-on in offensive security, vulnerability research, or application security
  • Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains
  • Strong coding in Python, Go, or similar, with production-quality code shipped
  • Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives
  • Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider
  • Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail
  • Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy
  • Takes research ideas from prototype to production with minimal guidance
  • Clear written communication — can explain a complex attack path to engineers and product managers
  • M.Sc. in Computer Science, Cyber Security, or a related field

Nice to have:

  • Published research, CVEs, conference talks, or a bug bounty track record
  • Experience building AI agents or evaluation frameworks for LLMs
  • Background in exploit development, red teaming, or penetration testing
  • Code analysis techniques (taint analysis, call graphs, reachability)
  • Contributions to open-source security tools

Similar roles