Security Researcher/ Threat Researcher

Job Description

• Design and develop vulnerability detection modules for Indusface's Haiku DAST scanner to identify web application and API security flaws.
• Research evolving web attacks, CVEs, and evasion techniques targeting web apps and APIs, and translate them into scanner detection logic and test payloads.
• Leverage AI tools and models (LLM-assisted coding, agentic pipelines, ML-based triage) to build detection logic and tooling faster and handle the growing volume of vulnerabilities, CVEs, and scan data in the AI era.
• Build and improve crawling/discovery logic (including authenticated, SPA/JS-heavy, and API-driven applications) to increase scan coverage.
• Improve scan accuracy reduce false positives/negatives, tune confidence scoring, and validate detection logic against real-world applications.
• Design and prototype new scanner capabilities such as authenticated scanning, API/GraphQL scanning, and business-logic testing.
• Outstanding problem-solving and troubleshooting skills are a must, as solutions to many problems might not be obvious.
• Drive the end-to-end release process for scanner engine updates and new detection modules.
• Coordinate with DevOps/Release teams to validate rollout on staging and production.
• Monitor post-release scan quality and lead fixes for regressions, missed detections, or false-positive spikes.
• Troubleshoot customer scan issues, provide timely solutions, and write RCAs wherever necessary.
• Develop security tools and automation to reduce manual/repeated work and increase efficiency of the scanning pipeline.

Candidate Profile

• 4+ years of experience in vulnerability research/analysis and hands-on DAST/dynamic scanner or VAPT tool development.
• AI models, tooling using Agentic AI
• Good understanding of:
• Web application and API architectures, crawling/spidering techniques
• Network security, network layers (OSI Layer-3 and Layer-4)
• Protocols like TCP/IP, DNS, HTTP, HTTPS, SSH, WebSockets
• Web application penetration testing techniques
• Identifying and mitigating web/network vulnerabilities and explaining how to prevent them
• Programming languages like Python, C/C++, or Java
• Hands-on experience in:
• Research on 0-days, critical vulnerabilities, exploits in the wild, and discovering new vulnerabilities
• Web-app security (SQL Injection, XSS, CSRF, SSRF, IDOR, etc.), OWASP Top 10, OWASP API Top 10, SANS Top 25
• DAST/scanner tools: Burp Suite, OWASP ZAP, Nessus, Qualys, Acunetix, or similar
• Network analysis tools like tcpdump, Wireshark, and assisting tools like debuggers, hex editors, etc.
• Crafting regular expressions for detection logic, and verification & validation of findings
• Building or extending scanner engines, plugins, or crawler modules
• Analyzing existing or writing new POCs for vulnerabilities
• Headless browser automation (Selenium/Playwright) for crawling JavaScript-heavy applications
• Experience with ML-assisted detection or behavioral models for reducing false positives is a plus
• Contributions to open-source security tools or research publications
• Certifications (e.g., OSWE, GWAPT, CEH, CISSP) are a plus
• Effective written and verbal communication skills.

Good to Have

• Knowledge of API security testing (REST/GraphQL/SOAP) and authentication/session-handling edge cases.
• Understanding of Lua, Nginx, Apache.
• Developing security-related tools/programs.
• Knowledge of cloud infrastructure services and virtualization software (VMware, VirtualBox, Xen, etc.).
• Experience in any of Java, TestNG, Linux scripting, shell scripting, Python, Perl.
• Experience/knowledge of Amazon Web Services (AWS).