Staff Security Researcher

About the role

Invicti Security, a provider of an application security platform, is hiring a Staff Security Researcher. The role suits a hands-on offensive security researcher who turns vulnerability and malware knowledge into detection content with low false-positive rates. The workplace is hybrid and candidates must be based in Malta.

Key responsibilities

• Create new detection rules (mainly OpenGrep) to catch novel malware and vulnerability patterns.
• Extend support for new programming languages across the analysis pipeline and explore new tools and techniques for threat detection.
• Research new vulnerability classes, exploitation techniques, cloud-native attack paths and AI-specific attack vectors, and turn them into production-ready detections.
• Build attack chain templates and evaluation harnesses and benchmarks measuring detection accuracy, false positives and coverage.
• Triage packages from the analysis pipeline, validate findings and help maintain detection quality.
• Mentor junior and mid-level researchers and collaborate with engineering, product, AI/ML and infrastructure teams.
• Write and publish blog posts, CVEs and conference contributions, and stay current on AppSec, AI red-teaming and LLM vulnerabilities.

Required profile

• 8+ years of offensive or application security research experience (Bachelor's + 5 years, or Master's + 3 years).
• Deep web application pentesting experience covering the OWASP Top 10, authentication, authorization, business logic and REST/GraphQL APIs.
• Fluent English and the ability to explain technical details to technical and non-technical audiences.

Required skills

• Broad knowledge of programming languages; JavaScript is a must, Python is a big plus.
• Detection writing for DAST scanners, fuzzers or similar systems.
• Offensive tooling such as Burp Suite, sqlmap, nmap, ffuf and custom payload generation.
• Desirable: OpenGrep or Semgrep, YARA, static analysis, cloud platforms, Kubernetes, containers, IaC and CI/CD security.
• Desirable: practical experience with LLM-powered applications, AI agents and MCP security.

What we offer

• Hybrid working schedule.
• Full coverage of employee health and dental premiums, and 50% of dental premiums for dependents.
• Free VDU testing, an Employee Assistance Program and family leave.
• Quarterly wellness days, 5 days of paid volunteer time off and paid birthday off.
• Mobile allowance and employee recognition.