Senior/Staff Security Researcher

About the role

Semgrep is looking for a senior security researcher to shape the future of automated code security. You will define research directions, work closely with customers, and translate findings into products that protect developers at scale.

Key responsibilities

• Design and ship security workflows that combine deterministic analysis (taint, reachability, static slicing) with LLM reasoning to detect real vulnerabilities across many languages.
• Engineer cost‑aware, trustworthy LLM‑driven pipelines, handling hallucination, confidence calibration, and model selection for sensitive code.
• Develop benchmarks and evaluation loops using real customer codebases to validate detection quality.
• Prototype new security products, collaborate with engineering and product, and produce production‑grade code.
• Publish research through blog posts, talks, cheat sheets, and represent Semgrep in the security community.

Required profile

• Deep expertise in application security, including common vulnerability classes and their manifestation across languages.
• Proven experience finding and explaining vulnerabilities to developers as a researcher or security engineer.
• Fluency writing and auditing code in at least two programming languages.
• Strong curiosity and hands‑on experience with applied AI/LLMs, prompt engineering, and evaluation.
• Ability to work autonomously, break ambiguous problems into milestones, and drive outcomes.

Required skills

• Application security and program analysis (taint analysis, static slicing, reachability).
• Static Application Security Testing (SAST) and rule‑based detection.
• Large language models, prompt engineering, and LLM‑driven workflows.
• Python‑based tooling (pydantic‑ai, multi‑provider orchestration, eval frameworks).
• Cloud‑native infrastructure such as Kubernetes, Argo, and Temporal.