Cybersecurity Researcher Our MissionSafety secures the software supply chain for the world's data and development teams. We protect everywhere packages are actually used, from local developer machines to production environments, from traditional IDEs to AI coding assistants without disrupting existing workflows. Our mission is to make open source packaging secure by default, providing complete visibility, governance, and protection across Python, Java, and JavaScript ecosystems.We're building the infrastructure that will secure companies and shape how enterprises adopt AI-driven development safely. If you're passionate about defending critical infrastructure at scale and want your work to directly protect millions of installations, we want you to join us.The RoleAs a Cybersecurity Researcher, you'll be the engine behind what makes Safety's security offering better than alternatives. Your research will directly contribute to protecting thousands of developers worldwide and millions of package installations across Python, Java, and JavaScript ecosystems.You'll hunt malicious packages in real-time, enrich vulnerability data that powers our industry-leading database, and validate reachability analysis that tells customers exactly which vulnerabilities matter in their code. Your research becomes the intelligence layer behind Safety's Firewall. When you catch a malicious release, you're auto-blocking attacks before they reach production environments.This isn't research in isolation. You'll work at the intersection of security analysis and product development, seeing your findings ship to customers within days. You'll develop detection rules that run against 70,000+ daily package releases, reduce false positives that improve customer trust, and contribute original research that positions Safety as a thought leader in supply chain security.RequirementsWhat You'll DoHunt Malicious Packages: Analyze suspicious packages across PyPI, npm, and Maven in real-time, developing detection rules that protect customers before threats reach productionEnrich Vulnerability Data: Review and validate vulnerabilities, adding reachability analysis and context that makes Safety's database more accurate than baseline sources like OSVReduce False Positives: Refine our own tooling and the detection logic by analyzing flagged packages, documenting patterns, and optimizing rules to improve customer trustBuild AI-Driven Detection Systems: Collaborate with data engineers to develop LLM-assisted analysis tools and automated detection processes that scale to 70,000+ daily package releasesDrive Research Innovation: Experiment with AI-powered techniques for vulnerability detection, changelog analysis, and threat identification to stay ahead of emerging attacksShip with Velocity: Embrace fast-paced iteration, deliver detection improvements quickly, refine based on customer feedback, and see your work protect thousands of developers and environments within daysEstablish Thought Leadership: Contribute original research through blog posts and conference presentations that position Safety as an industry leader in supply chain securityAbout YouSecurity Research Experience: multi-year experience in cybersecurity research with hands-on experience investigating both accidental vulnerabilities and intentionally malicious components in software supply chainsEcosystem Expertise: Deep understanding of package ecosystems (PyPI, npm, Maven) including how they work, common attack vectors, and vulnerability patterns, with programming ability in Python, Java, or JavaScriptAI-Powered Analysis: Experience using LLMs (GPT, Claude, Copilot) for security research, code analysis, or threat detection. Comfortable experimenting with prompts and integrating AI into research workflowsDetection Development: Track record of building or improving automated security detection systems, including writing rules, reducing false positives, and scaling analysis to large datasetsVelocity & Collaboration: Comfortable working in fast-paced environments where research ships to production quickly, with strong communication skills for remote team collaborationMission-Driven: Passionate about protecting the open-source ecosystem and staying ahead of emerging threats in supply chain securityBonus PointsExperience building or contributing to security tools, malware analysis frameworks, or threat intelligence platformsBackground in static analysis, dynamic analysis, or software composition analysisPublished security research, CVE discoveries, or conference presentationsContributions to open-source security projects or vulnerability databasesExperience with data engineering pipelines or working closely with ML/data teamsBenefitsCompensation & BenefitsWe prioritize supporting our team’s growth, wellness, and success. Benefits include:Competitive salary: 120,000 CAD - 150,000 CAD (depending on experience)20 days paid vacation per yearPrivate Healthcare PlanGenerous equity stock options to share in our successAbility to work remotely and thrive in an adaptable, inclusive environmentFlexible working hours, providing responsibilities are effectively managedOur Team CultureWe believe in building products that make a real difference in the security landscape. Our team values technical excellence, open collaboration, and continuous learning.One of our core commitments to our team and the culture is fostering belonging. We're committed to fostering an inclusive environment where diverse perspectives are valued and everyone's growth is supported. We recognize the value diversity brings not only to us as individuals, but as an organization. And we go out of our way to make each other feel understood, respected, and supported.Check out our Core Commitments here.Our Commitment to InclusionWe believe that diverse teams build better products. We actively and strongly encourage applications from individuals who identify as women, people of color, 2SLGBTQI+, Indigenous, First Nations, Inuit