Senior Security Researcher

The role

The Senior Security Researcher will detect, triage, and analyze malicious open source software components across public package ecosystems. This role involves reverse-engineering suspicious packages and authoring external security communications to communicate findings.

What you will do

• Detect, triage, and analyze malicious open source software components.
• Identify threats across public package ecosystems like npm, PyPI, and Maven.
• Assess scope, intent, and impact of threats.
• Triage and assess incoming malware alerts.
• Review Indicators of Compromise (IoCs).
• Maintain threat campaign records to track attacker infrastructure, tactics, and patterns.
• Perform in-depth technical analysis of suspicious packages through reverse-engineering obfuscated code.
• Identify malicious behaviors such as exfiltration, backdoors, dependency confusion, and typosquatting.
• Produce detailed internal assessments.
• Author and publish external-facing content including blog posts, technical write-ups, and security advisories.

Required qualifications

• Bachelor's degree in engineering or a related field
• At least 3 years of hands-on professional experience in malware analysis, threat intelligence, or open source package security
• Demonstrated experience triaging security alerts at scale
• Experience working within or alongside a SOC or threat intelligence team
• Hands-on experience reviewing and interpreting IoCs (file hashes, domains, IPs, behavioral signatures)
• Experience maintaining threat campaign tracking
• Proficiency in reading and analyzing code across multiple languages (Python, JavaScript/TypeScript, Java, Go)
• Experience analyzing obfuscated or minified code
• Experience producing external security communications such as blog posts, advisories, or technical reports

Nice to have

• Experience contributing to or operating threat intelligence platforms or malware databases
• Familiarity with static and dynamic analysis tooling (sandboxes, YARA rules, SAST tools)
• Understanding of software supply chain security standards and frameworks (SLSA, SSDF, etc.)
• Prior public research, CVE credits, or published malware findings
• Security certifications such as GREM (GIAC Reverse Engineering Malware) or equivalent

About the company

Endor Labs provides security and safety for AI agents through its AURI platform and patented code context graph. The company was founded by Varun Badhwar and has raised $163M from investors including Lightspeed and Salesforce Ventures.