Invicti seeks a Staff Security Researcher (Europe-remote) to create and maintain detection rules (primarily OpenGrep), research novel vulnerabilities and malware (including AI/LLM attack vectors), extend language support in the analysis pipeline, build evaluation harnesses and benchmarks, triage findings, and mentor junior researchers. Requires 8+ years of offensive or application security research experience, strong JavaScript (required) and Python (preferred) skills, deep web-app pentesting and detection-writing experience, and familiarity with cloud-native platforms and CI/CD security.

Hands-on offensive security researcher role focused on building and maintaining DAST detection rules and detection engineering for web apps and APIs. Requires 5+ years in offensive/application security research, strong JavaScript (Python preferred), web pentesting experience (OWASP Top 10), familiarity with detection tools and CI/CD/cloud environments, and fluent English. Open to candidates residing anywhere in Europe (CET ±2).

Hands-on offensive security researcher role responsible for creating detection rules (primarily OpenGrep), researching new vulnerability and malware classes, building proof-of-concept attacks, designing evaluation harnesses and benchmarks, and collaborating with engineering and platform teams to ship and maintain detection capabilities. Requires 8+ years of offensive/application security research experience, strong JavaScript knowledge (Python a plus), deep web app pentesting and detection-writing experience, and familiarity with cloud-native platforms and CI/CD security. Role is based in the United States with a hybrid schedule (twice weekly in the Austin office).