Security Research Engineer

The role

This person will conduct security assessments, manual penetration testing, and vulnerability research on web apps, APIs, and cloud services. They will partner with engineering teams to provide secure coding guidance and integrate security testing into CI/CD pipelines.

What you will do

• Conduct in-depth security assessments and manual penetration testing of web apps, APIs, and cloud services.
• Perform source code reviews and analyze proprietary applications for flaws.
• Develop custom tooling and Proof-of-Concept (POC) exploits to validate findings.
• Research emerging attack techniques, exploit chains, and zero-day vulnerabilities.
• Conduct threat modeling and evaluate software supply chain and dependency risks.
• Partner with engineering teams to provide secure coding guidance and support architecture reviews.
• Integrate security testing into CI/CD pipelines.
• Contribute to internal security standards.
• Document vulnerabilities, exploitability, and remediation guidance in clear reports.
• Present findings to stakeholders, track remediation efforts, and verify fixes.

Required qualifications

• 5+ years of experience in application security, vulnerability research, or offensive security.
• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent practical experience.
• Strong knowledge of secure development practices, manual security assessments, and source code reviews.
• Deep understanding of OWASP Top 10, API Security Top 10, modern web application architectures, secure authentication and authorization models, and cloud security fundamentals.
• Proficiency with one or more programming languages (Python, Java, JavaScript/TypeScript).
• Strong understanding of Linux, networking, and web protocols.
• Experience using common security testing tools.

Nice to have

• Experience discovering novel vulnerabilities, participating in bug bounty/disclosure programs, or background in exploit development/reverse engineering.
• Knowledge of modern cloud environments (AWS, Azure, GCP), container security/Kubernetes, and building custom security tooling.
• Experience with current vulnerability research tools ( i.e. Burp Suite, Nuclei, Ghidra).
• Public vulnerability research, conference presentations, blog posts, or published CVEs.
• OSCP
• OSWE
• OSEP
• GXPN
• Relevant GIAC certifications

Benefits

• Competitive compensation
• Comprehensive benefits
• Continuous opportunities for professional development

Before you apply

• Cowbell Cyber does not permit the use of AI tools during any stage of our interview process.

About the company

Cowbell is a cyber insurance company that uses technology and data to provide SMEs with cyber risk exposure warnings and insurance coverage. Founded in 2019 and based in the San Francisco Bay Area, it operates across the U.S., Canada, U.K., and India.