Senior Security Researcher

Responsibilities

• Design systems to scan open-source packages (npm, PyPI, RubyGems, Maven, etc.) for malicious behavior at scale
• Hunt novel malicious packages, typosquats, dependency confusion, and CI/CD abuse patterns
• Coordinate with maintainers and registries to file CVEs and work with GitHub Security Advisories
• Build internal tooling using static analysis and AI models to triage findings and cluster campaigns
• Publish technically rigorous blog posts for significant findings to drive community engagement
• Tune detection signals and develop countermeasures against sandbox evasion techniques

Requirements

• 4+ years of security research experience with published CVEs or GHSAs
• Deep expertise in vulnerability classes like RCE, prototype pollution, SSRF, and CI/CD attack paths
• Experience designing and operating large-scale detection or scanning pipelines
• Strong programming skills in TypeScript, Python, Go, or Rust
• Ability to read code across multiple languages including JavaScript, Ruby, Java, and PHP
• Proven track record of writing high-quality technical blog posts and using LLMs as research tools

Preferred Qualifications

• Contributions to OpenSSF, OSV, Sigstore, or SLSA projects
• Reverse engineering experience with obfuscated JavaScript or malicious post-install scripts
• Conference speaking experience at DEF CON, Black Hat, or BSides

About the Company

Point Wild helps customers monitor, manage, and protect against the risks associated with their identities and personal information in a digital world. Backed by WndrCo, Warburg Pincus and General Catalyst, Point Wild is dedicated to creating a comprehensive portfolio of industry-leading cybersecurity solutions.