Sr Security Researcher

<h2><strong>Who we are</strong></h2> <p>Our mission is to help developers and AppSec teams spend more time accelerating development and less time dealing with security issues. Watch our 3 min pitch from our Founder &amp; CEO here:&nbsp;<a href="https://www.youtube.com/watch?v=B0wmZBcPkFE">https://www.youtube.com/watch?v=B0wmZBcPkFE</a></p> <p>Endor Labs has been recognized as a Gartner Cool Vendor, a RSA Innovation Sandbox finalist, and a Black Hat Innovation Spotlight finalist, all in its first year from launch.</p> <p>The company was founded by&nbsp;<a href="https://www.linkedin.com/in/vbadhwar/">Varun Badhwar</a>&nbsp;and&nbsp;<a href="https://www.linkedin.com/in/stiliadis/">Dimitri Stiliadis</a>, who have created multiple category-defining cloud security companies. We have raised $70M in Series A funding and assembled a team of the world’s leading static analysis experts and enterprise software veterans to increase developer productivity and open source software adoption.</p> <h2><strong>What you’ll do</strong></h2> <ul> <li>The primary tasks of this position relate to the detection, triage, and analysis of malicious open source software components — identifying threats across public package ecosystems (npm, PyPI, Maven, etc.) and assessing their scope, intent, and impact.</li> <li>Day-to-day work includes triaging and assessing incoming malware alerts, reviewing Indicators of Compromise (IoCs), and maintaining threat campaign records to track attacker infrastructure, tactics, and patterns over time.</li> <li>A core responsibility is the in-depth technical analysis of suspicious packages: reverse-engineering obfuscated code, identifying malicious behaviors (exfiltration, backdoors, dependency confusion, typosquatting, etc.), and producing detailed internal assessments.</li> <li>You will author and publish external-facing content — blog posts, technical write-ups, and security advisories — communicating findings clearly to both technical and non-technical audiences, and contributing to the broader security community's awareness of emerging threats.</li> <li>You will collaborate with internal teams to feed findings into detection pipelines, enrich our vulnerability and threat database, and help improve automated detection coverage over time.</li> </ul> <h2><strong>What </strong><strong>we're looking for&nbsp;</strong></h2> <ul> <li>Bachelor's degree in engineering or a related field, with at least 3 years of hands-on professional experience specifically in malware analysis, threat intelligence, or open source package security</li> <li>Demonstrated experience triaging security alerts at scale and working within or alongside a SOC or threat intelligence team</li> <li>Hands-on experience reviewing and interpreting IoCs (file hashes, domains, IPs, behavioral signatures) and maintaining threat campaign tracking</li> <li>Proficiency in reading and analyzing code across multiple languages (Python, JavaScript/TypeScript, Java, Go) — including obfuscated or minified code</li> <li>Experience producing external security communications: blog posts, advisories, or technical reports intended for a public or customer-facing audience</li> <li>Understanding of package manager ecosystems and common attack patterns (typosquatting, dependency confusion, malicious install scripts, etc.)</li> </ul> <h2><strong>Nice to have</strong></h2> <ul> <li>Experience contributing to or operating threat intelligence platforms or malware databases</li> <li>Familiarity with static and dynamic analysis tooling (sandboxes, YARA rules, SAST tools)</li> <li>Understanding of software supply chain security standards and frameworks (SLSA, SSDF, etc.)</li> <li>Prior public research, CVE credits, or published malware findings</li> <li>Security certifications such as GREM (GIAC Reverse Engineering Malware) or equivalent</li> </ul> <h2><strong>At Endor Labs, we:</strong></h2> <ul> <li style="font-weight: 400;">Strive for excellence in everything we do, prioritizing quality, speed, and impactful outcomes.</li> <li style="font-weight: 400;">Engage in first principles thinking to debate ideas, test assumptions, and make decisions.</li> <li style="font-weight: 400;">Put data above opinions, seeking truth and clarity in all our endeavors.</li> <li style="font-weight: 400;">Embrace a culture of feedback and continuous improvement, assuming good intent in all interactions.</li> <li style="font-weight: 400;">Celebrate wins as a team, understanding that our collective success is intertwined with the success of our customers.</li> </ul> <p>&nbsp;</p>