Senior Security Operations Engineer

About the role

Invicti Security, a provider of an application security platform that scans and secures web apps and APIs, is hiring a Senior Security Operations Engineer. The role suits a hands-on offensive security researcher who turns vulnerability and malware knowledge into detection content with high accuracy and low false positives. The workplace is hybrid and candidates must be based in Malta.

Key responsibilities

• Build and maintain security checks and detection content for the Invicti platform, focused on accuracy, coverage and low false-positive rates.
• Create new detection rules (mainly OpenGrep) to catch novel malware and vulnerability patterns.
• Research vulnerability classes, exploitation techniques and emerging attack patterns and turn them into production-ready detections.
• Extend support for new programming languages across the analysis pipeline and triage packages from it, validating findings.
• Build attack chain templates that combine low-severity findings into higher-impact detection scenarios.
• Contribute to evaluation harnesses and benchmarks, and build testing frameworks for detection quality and regression coverage.
• Refine internal detection and exploitation standards and stay current on AppSec, AI security, LLM vulnerabilities and related topics.
• Collaborate with engineering, product, AI/ML and infrastructure teams, and use cloud-native infrastructure and CI/CD pipelines to integrate detection into the development lifecycle.

Required profile

• 5+ years of offensive security or application security research experience (Bachelor's degree plus 2 years, or equivalent).
• Broad knowledge of programming languages; JavaScript is a must, Python is a big plus.
• Understanding of vulnerability classifications, exploitation techniques and common software weaknesses.
• Web application pentesting experience covering the OWASP Top 10, including authentication, authorization, business logic and REST/GraphQL APIs.
• Fluent English, able to explain technical details to technical and non-technical audiences.

Required skills

• Detection writing for DAST scanners, fuzzers or similar systems, including false-positive management.
• Offensive tooling such as Burp Suite, sqlmap, nmap, ffuf and custom payload generation.
• Cloud infrastructure, containers and CI/CD pipelines are a plus.
• Bonus points: OpenGrep or Semgrep, static analysis, YARA, LLMs and prompt engineering, public security research output.

What we offer

• Hybrid office/home schedule.
• Full coverage of employee health and dental premiums, and 50% of dental premiums for dependents.
• Free VDU testing, an Employee Assistance Program and family leave.
• Quarterly wellness days, 5 days of paid volunteer time off and paid birthday off.
• Mobile allowance and employee recognition.