Senior Security Research Engineer (SecureChain)
TuxCare
/job-details/12382
**TuxCare** provides security solutions for Linux and open-source software used by enterprise organizations. Our products help companies automate vulnerability patching, reduce downtime, maintain security and compliance, and support critical systems throughout their lifecycle.
Learn more about TuxCare: [tuxcare.com](https://tuxcare.com/)
**We are looking for a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain.**
**SecureChain** is TuxCare's open-source software supply chain security product. It provides packages rebuilt from verified source code, scanned for malware and supply chain risks.
Learn more: [tuxcare.com/securechain-for-oss](https://tuxcare.com/securechain-for-oss/)
**The Mission**
You will be the first engineer of a new function, with a plan to grow it to three or four people. You are a security researcher first, and you build production-quality tools and pipelines to scale your research.
The function has three goals:
1. Detect malicious code before SecureChain publishes a package.
2. Build pipelines that find and help fix high and critical vulnerabilities in maintained and end-of-life open-source software.
3. Publish useful, evidence-backed security research after coordinated disclosure.
**You will be responsible for:**
- Owning SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.
- Extending detection with artifact scanning, static signals, dynamic analysis and external intelligence.
- Building repeatable pipelines that discover new vulnerabilities in software that SecureChain and ELS support, with priority on high/critical risks and on EOL versions customers still use.
- Reproducing findings, proving impact and reachability, and storing evidence so another researcher can repeat the result.
- Developing AI-assisted methods to generate and test candidate fixes, and feeding them into our patch automation.
- Owning TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.
- Preparing technical write-ups and research publications together with Marketing.
**Your first 90 days:**
- **Days 1–30:** take over the malicious-code detector, its sample review and CNA responsibilities; inventory services, data, prompts, corpus and open work.
- **Days 31–60:** improve the detector and its review workflow, measure alert volume, false positives and cost; start a vulnerability-discovery pilot on 5–10 packages of one ecosystem.
- **Days 61–90:** expand discovery across the ecosystem, complete coordinated disclosure where applicable, publish the first research output.
### Requirements
**Must-haves:**
- Security research background: malware or software supply-chain research, vulnerability discovery and root-cause analysis.
- Strong Python or another suitable systems language; you build tools and pipelines that run in production.
- CI pipelines, test automation and operating services.
- Practical use of static analysis, fuzzing and sandboxing.
- Heavy, daily use of AI-assisted tools in research and engineering.
- Experience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).
- Clear research reports and experience with coordinated disclosure.
- Advanced written and spoken English.
**Nice-to-haves:**
- Published CVEs, advisories or security research.
- Experience with CNA operations or vulnerability databases (CVE, OSV).
This is not a SOC analyst, compliance, penetration testing or general software development role.
### Benefits
**What's in it for you?**
- A focus on professional development.
- Interesting and challenging projects.
- Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.
- Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.
- Compensation for private medical insurance.
- Co-working and gym/sports reimbursement.
- Budget for education.
- The opportunity to receive a reward for the most innovative idea that the company can patent.
*By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy (*[https://tuxcare.com/privacy-policies-hub/candidate-privacy-notice/](https://tuxcare.com/privacy-policies-hub/candidate-privacy-notice/)[*)*](https://cloudlinux.com/legal/privacy-policies-hub/)*, which provides detailed information on how we maintain and handle your data.*
Learn more about TuxCare: [tuxcare.com](https://tuxcare.com/)
**We are looking for a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain.**
**SecureChain** is TuxCare's open-source software supply chain security product. It provides packages rebuilt from verified source code, scanned for malware and supply chain risks.
Learn more: [tuxcare.com/securechain-for-oss](https://tuxcare.com/securechain-for-oss/)
**The Mission**
You will be the first engineer of a new function, with a plan to grow it to three or four people. You are a security researcher first, and you build production-quality tools and pipelines to scale your research.
The function has three goals:
1. Detect malicious code before SecureChain publishes a package.
2. Build pipelines that find and help fix high and critical vulnerabilities in maintained and end-of-life open-source software.
3. Publish useful, evidence-backed security research after coordinated disclosure.
**You will be responsible for:**
- Owning SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.
- Extending detection with artifact scanning, static signals, dynamic analysis and external intelligence.
- Building repeatable pipelines that discover new vulnerabilities in software that SecureChain and ELS support, with priority on high/critical risks and on EOL versions customers still use.
- Reproducing findings, proving impact and reachability, and storing evidence so another researcher can repeat the result.
- Developing AI-assisted methods to generate and test candidate fixes, and feeding them into our patch automation.
- Owning TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.
- Preparing technical write-ups and research publications together with Marketing.
**Your first 90 days:**
- **Days 1–30:** take over the malicious-code detector, its sample review and CNA responsibilities; inventory services, data, prompts, corpus and open work.
- **Days 31–60:** improve the detector and its review workflow, measure alert volume, false positives and cost; start a vulnerability-discovery pilot on 5–10 packages of one ecosystem.
- **Days 61–90:** expand discovery across the ecosystem, complete coordinated disclosure where applicable, publish the first research output.
### Requirements
**Must-haves:**
- Security research background: malware or software supply-chain research, vulnerability discovery and root-cause analysis.
- Strong Python or another suitable systems language; you build tools and pipelines that run in production.
- CI pipelines, test automation and operating services.
- Practical use of static analysis, fuzzing and sandboxing.
- Heavy, daily use of AI-assisted tools in research and engineering.
- Experience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).
- Clear research reports and experience with coordinated disclosure.
- Advanced written and spoken English.
**Nice-to-haves:**
- Published CVEs, advisories or security research.
- Experience with CNA operations or vulnerability databases (CVE, OSV).
This is not a SOC analyst, compliance, penetration testing or general software development role.
### Benefits
**What's in it for you?**
- A focus on professional development.
- Interesting and challenging projects.
- Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.
- Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.
- Compensation for private medical insurance.
- Co-working and gym/sports reimbursement.
- Budget for education.
- The opportunity to receive a reward for the most innovative idea that the company can patent.
*By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy (*[https://tuxcare.com/privacy-policies-hub/candidate-privacy-notice/](https://tuxcare.com/privacy-policies-hub/candidate-privacy-notice/)[*)*](https://cloudlinux.com/legal/privacy-policies-hub/)*, which provides detailed information on how we maintain and handle your data.*
