Associate Security Researcher

Our Opportunity

We’re looking for an Associate Security Researcher to join Snyk’s Hunter team and take part in research-led work developing the rules for the Snyk Code SAST engine. We regularly look at new and emerging languages, technologies and frameworks to better model the source code we analyse for our customers, helping them identify potential security vulnerabilities before their code reaches production.

You’ll Spend Your Time:

• Writing security rules to detect known and unknown vulnerabilities using a proprietary language and built-for-purpose tooling.
• Working closely with other teams involved in Snyk Code related to Program Analysis and Machine Learning
• Learning the mechanics of a programming language or a framework, including looking at best practices and common vulnerable patterns.
• Dealing with customer issues i.e. resolving false positive or false negative issues, to help cement our position as the most accurate tool in the market.
• Taking part in independent research projects on research days and on a rotational basis.
• Writing blog posts about the research projects, i.e: https://snyk.io/blog/finding-yaml-injection-with-snyk-code/, [https://snyk.io/blog/the-dangers-of-setattr-avoiding-mass-assignment/>
• Performing exploratory research in order to better understand potential gaps in the system, or guide our way towards implementation of features.
• Writing company blog posts about your work and accomplishments, and to deliver presentations to the technical community both inside of Snyk and externally
• Presenting your research at security working groups, conferences, and in publications.

What You’ll Need:

• Proficiency with a variety of high level programming languages (Python, Javascript, Java, C#, Go) and an excitement for learning and diving into unfamiliar programming languages.
• A passion for security, and a desire to contribute to the community.
• Interest in learning about the mechanics and inner workings of a language or a framework.
• Strong communication skills in English, spoken and written.

We’d be Lucky if You:

• Have taken part in CTF’s, bug-bounty programs or similar.
• Enjoy hunting for security vulnerabilities through the wilds of open source software security.

#LI-HW1