Security Researcher

Tracebit co; City of London; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

A cybersecurity firm is seeking a Security Researcher to expand their research function. Successful candidates should have over 5 years of experience in offensive security and vulnerability research, with a focus on cloud environments. Responsibilities include conducting novel research, investigating attacks, and publishing findings. The role offers the flexibility of either working in their London office or fully remote, with quarterly visits expected.

Qualifications

• 5+ years in offensive security or vulnerability research.
• Published security researcher with a track record of communication.
• Comfortable writing and reading code.

Responsibilities

• Conduct deep technical research into complex cloud services.
• Investigate real-world attacks across cloud environments.
• Publish research through various channels.

Skills

Offensive security

Vulnerability research

Cloud platforms (AWS, Azure, GCP)

Technical communication

Code writing and analysis

Self-direction

Job description

See how canaries can enhance your security

Andy Smith

CEO, Tracebit

Sam Cox

CTO, Tracebit

Schedule a 45 minute personalised demo of Tracebit with one of our co-founders to:

• Discuss your specific security challenges
• Cover the range of canaries Tracebit can deploy for your use case
• Walk through a simple Tracebit deployment

One of our co-founders will reply to you directly as soon as they see your request. No bots here! So please be patient if it takes us a few hours to get back to you.

Thank you for contacting us; a member of our team will be in touch shortly.

Why we're hiring

Our product helps security teams quickly and accurately detect intrusions in their cloud environment using canaries - decoys deployed to deceive attackers.

Our research has already made an impact:

• We\'ve disclosed vulnerabilities in Google\'s Gemini CLI

We work with some of the world\'s leading security teams at companies like Snyk, Riot Games, and Docker.

We\'re at a key stage: we need someone to expand and formalize our research function, turning findings into actionable insights and engaging content while helping Tracebit contribute to the wider security community.

Who we\'re looking for

5+ years in offensive security or vulnerability research with deep focus on cloud platforms (AWS, Azure, GCP). You\'ve found and disclosed vulnerabilities before.

Published security researcher. Track record of blog posts, conference talks, CVEs, or bug bounty submissions. You know how to communicate technical findings clearly.

Technical. Comfortable writing and reading code, and analysing data. You can write scripts, build tooling, and create detection rules.

Self-directed. You're excited to build a research practice from scratch without perfect processes or large teams.

About the role

Reporting to Sam, our CTO and Co-Founder, you\'ll expand our security research practice and conduct novel research that directly improves our product.

Your core focus:

• Conduct deep technical research into complex cloud services to uncover novel attack vectors.
• Investigate real-world attacks across cloud environments, identity providers (IDPs), and infrastructure-as-a-service (IaaS) platforms.
• Help our team design new canary types and improve our product based on your research.
• Publish research through blog posts, conference talks (BlackHat, RSA, BSides, fwd:cloudsec), and community engagement.
• Monitor the threat landscape and proactively research emerging attack techniques to write detections and blog posts
• Represent Tracebit at industry conferences globally and build relationships with other researchers.

You'll find attack vectors, write content, and see our engineering team deploy your findings to protect customers.

FAQs

Where is the office?

The whole team works together in an office right next to Warren Street tube station - there are lots of great places to grab lunch nearby.

Are you doing hybrid/remote?

This role can be based either in our London office or fully remote.

We are an office-first company - all of our team works together in London 5 days a week. However, we\'re making an exception for this role given the nature of the work and the need to hire the best talent in this space.

If you\'re based in London, you\'ll work from our office. If you\'re remote, we expect you to visit London at least quarterly to collaborate with the team in person.

What are the working hours like?

We think 9am-6pm will bring a great cadence to work. As a Security Researcher there will definitely be times you need to pick up work outside of these hours, we\'re keen to limit this where we can but also offer flexibility in return.

Can you sponsor visas?

We can support various types of working visas in the UK, including:

• Skilled Worker Visa (both from within and outside the UK)
• Intra-Company Transfer Visa

We are keen to support candidates who require visa sponsorship. Please let us know which specific visa type you might need during the initial application or interview process. Our team is committed to helping talented individuals navigate the necessary visa requirements.