Security Engineer

• Create new OpenGrep detection rules for novel malware and vulnerability patterns
• Extend support for new programming languages across the analysis pipeline
• Experiment with tools and techniques to detect threats and malware at scale
• Research exploitation and analysis of modern web applications and APIs
• Build proof-of-concept attacks and translate findings into shippable capabilities
• Research vulnerability classes, exploitation techniques, cloud-native attack paths, and AI-specific attack vectors
• Convert research into production-ready detections
• Contribute to research standards, policies, and attack methodologies
• Build attack chain templates combining low-severity findings into high-impact exploitation paths
• Design and maintain evaluation harnesses, testing frameworks, and benchmarking systems
• Measure detection effectiveness, exploit reproducibility, false-positive rates, and coverage
• Contribute to internal research and shape the public research agenda
• Write and publish blog posts on novel attacks and large-scale incidents
• Represent Invicti in the security community through CVEs, tool releases, and conference contributions
• Monitor AppSec, AI red-teaming, offensive AI, LLM vulnerabilities, agent security, MCP security, and cloud-native attack trends
• Triage analysis-pipeline packages and validate findings
• Mentor junior and mid-level researchers
• Collaborate with engineering, product, AI/ML, and infrastructure teams
• Partner with platform and infrastructure teams to improve CI/CD and cloud-native security automation
• Maintain detection quality by triaging difficult or ambiguous findings

Staff Security Researcher – Europe

• Ensure Bondora’s systems, data, and customers remain protected while building toward a banking licence
• Own information security hands-on, including incident response
• Collaborate with product engineering, SRE, IT, and compliance teams
• Conduct security reviews of architecture and significant product changes
• Perform security hardening across secrets management, access control, network segmentation, logging and alerting, and CI/CD pipeline security
• Design and coordinate external penetration tests, red team exercises, and DORA-mandated TLPT
• Translate security findings into a realistic remediation backlog
• Monitor and evaluate the DORA ICT risk management framework
• Work with all lines of defence on practical policy application
• Maintain documentation of quality assurance processes, audits, results, and action points
• Prepare and prioritize business requirements for necessary changes

Head of Information Security

• Contribute to security-by-design for hardware products, embedded systems, and integrated hardware-software solutions
• Perform threat modelling and security risk analysis for devices, components, interfaces, and firmware
• Define and implement hardware and firmware security controls, including secure boot, roots of trust, key protection, device identity, and secure update mechanisms
• Support secure hardware architecture and component selection from a security perspective
• Assess attack surfaces including debug interfaces, physical access, communications interfaces, and firmware update paths
• Plan and perform security testing, hardening, and validation of prototypes and product components
• Work with systems, software, electronics, and mechanical engineers to integrate security requirements into product designs
• Contribute technical content to R&D project deliverables, engineering reports, and test documentation
• Produce security requirements, threat models, risk assessments, implemented security mechanisms and configurations, security test plans and results, mitigation recommendations, and technical R&D documentation

Security Engineer – Hardware Product Security, R&D

• Threat model new services with product engineers
• Review code and infrastructure-as-code
• Build tooling that automatically catches recurring security problems
• Harden the cloud environment, mainly AWS and some GCP, including IAM, network boundaries, secrets/key management, logging, Kubernetes workloads, and Okta identity engineering
• Own the vulnerability cycle end to end, including CI/CD security gates, scanning, remediation, and penetration testing
• Build and maintain detections on native cloud services and company code
• Own detection queries, functions, and runbooks
• Act as a first responder on security incidents
• Support the Head of Security on PCI DSS, SOC 2, and ISO 27001, including testing and recurring compliance activities
• Support the IT Lead with corporate-environment automation, complex investigations, and absence cover
• Help engineers adopt reusable security patterns and secure defaults
• Provide a standing slot for security questions
• Work directly with the Head of Security to secure Tuum’s banking platform, cloud infrastructure, CI/CD pipeline, and product code