Senior Security Engineer - Vulnerability Management

Who we are

Our mission is to help developers and AppSec teams spend more time accelerating development and less time dealing with security issues. Watch our 3 min pitch from our Founder & CEO here: https://www.youtube.com/watch?v=B0wmZBcPkFE

Endor Labs has been recognized as a Gartner Cool Vendor, a RSA Innovation Sandbox finalist, and a Black Hat Innovation Spotlight finalist, all in its first year from launch.

The company was founded by Varun Badhwar and Dimitri Stiliadis, who have created multiple category-defining cloud security companies. We have raised $70M in Series A funding and assembled a team of the world’s leading static analysis experts and enterprise software veterans to increase developer productivity and open source software adoption.

What you’ll do

• The primary focus of this position is to help the team further advance Endor Labs'proprietary vulnerability database — extending and improving our existing AI pipelines,
• e.g., in the areas of automated vulnerability validation, reachability analysis, and exploit generation.
• Day-to-day work includes monitoring and managing pipelines that triage, enrich, and prioritize vulnerabilities at scale, working with the standards and data sources the
• ecosystem is built on (CVE, CWE, CVSS, EPSS, PURL, NVD, OSV, GHSA, VEX) and continuously improving the accuracy, coverage, and timeliness of our data.
• You will work hand-in-hand with our world-class 0-day researchers to scale automated vulnerability discovery — turning manual research workflows into repeatable,
• production-grade systems.
• You will investigate high-impact vulnerabilities and the vulnerability landscape at large, and author external-facing content — blog posts, technical write-ups, and advisories —
• communicating findings clearly to both technical and non-technical audiences.
• You will collaborate with internal teams to feed findings into detection and analysis pipelines, enrich our vulnerability database, and help improve automated coverage over
• time

What we're looking for

• Bachelor's degree in engineering or a related field, with at least 3 years of hands-on professional experience in vulnerability research, vulnerability management, product
• security, or application security
• Extensive knowledge of software vulnerabilities, triage, and prioritization, including deep familiarity with the associated standards and technologies (CVE, CWE, CVSS, EPSS,
• PURLs, NVD, OSV, VEX, SBOM formats)
• Hands-on experience building production-grade solutions at enterprise scale — e.g., CI/CD automation, management of SAST/SCA findings, or comparable security tooling
• deployed across large engineering organizations
• Demonstrated experience shipping AI/agentic systems to production — LLM pipelines, agent frameworks, tool use, prompt and eval design — with a clear track record of
• measuring output quality and a sound sense of where these approaches hold up and where they don't
• Proficiency in reading and analyzing code across multiple languages (Python, JavaScript/TypeScript, Java, Go), and comfort reasoning about patches, root causes,
• and exploitability
• Experience producing external security communications: blog posts, advisories, or technical reports intended for a public or customer-facing audience
• Nice to have
• Experience writing proof-of-concept exploits, or with fuzzing, static analysis, or automated vulnerability discovery
• Contributions to open source vulnerability databases, scanners, or related tooling (OSV, osv-scanner, OpenVEX, etc.)
• Familiarity with SAST, SCA, and DAST tooling and the realities of triaging their output at scale
• Understanding of software supply chain security standards and frameworks (SLSA, SSDF, etc.)
• Prior public research, CVE credits, or published vulnerability findings
• Security certifications such as OSCP, OSCE, or equivalent

At Endor Labs, we

• Strive for excellence in everything we do, prioritizing quality, speed, and impactful outcomes.
• Engage in first principles thinking to debate ideas, test assumptions, and make decisions.
• Put data above opinions, seeking truth and clarity in all our endeavors.
• Embrace a culture of feedback and continuous improvement, assuming good intent in all interactions.
• Celebrate wins as a team, understanding that our collective success is intertwined with the success of our customers.