Senior Security Research Engineer (SecureChain)

About the role

TuxCare builds security solutions for Linux and open-source software used by enterprises, and is looking for a Senior / Principal Security Research Engineer to start the Security Research & Automation function of SecureChain, its open-source supply-chain security product. SecureChain rebuilds packages from verified source code and scans them for malware and supply-chain risks. You will be the first engineer of a new function, growing it to three or four people, and will build production-quality tools and pipelines.

Key responsibilities

• Own SecureChain's malicious-code detector: alert review and classification, test corpus, quality benchmarks, false-positive and coverage metrics.
• Extend detection with artifact scanning, static signals, dynamic analysis and external intelligence.
• Build repeatable pipelines that discover new vulnerabilities in supported software, prioritising high/critical risks and end-of-life versions.
• Reproduce findings, prove impact and reachability, and store evidence so another researcher can repeat the result.
• Develop AI-assisted methods to generate and test candidate fixes and feed them into patch automation.
• Own TuxCare CNA work: CVE assignment, record quality and coordinated disclosure with upstream projects.
• Prepare technical write-ups and research publications together with Marketing.

Required profile

• Security research background: malware or supply-chain research, vulnerability discovery and root-cause analysis.
• Experience with more than one package ecosystem (e.g. PyPI, npm, Maven, Go, Linux distributions).
• Clear research reports and experience with coordinated disclosure.
• Advanced written and spoken English.
• Nice to have: published CVEs, advisories or research; experience with CNA operations or vulnerability databases (CVE, OSV).

Required skills

• Strong Python or another suitable systems language, building production tools and pipelines.
• CI pipelines, test automation and operating services.
• Static analysis, fuzzing and sandboxing.
• Daily use of AI-assisted tools in research and engineering.

What we offer

• Fully remote work with flexible hours, from anywhere in the world.
• Paid 24 days of vacation per year, 10 national holidays and unlimited sick leave.
• Compensation for private medical insurance, co-working and gym/sports reimbursement, and a budget for education.
• A chance to receive a reward for the most innovative idea the company can patent.