Security Researcher

About Element

Element Security is a leader in external attack surface security. Our platform helps organizations take control of their real-world exposure by safely validating which security issues are actually exploitable, allowing teams to focus on what truly matters.

Unlike traditional exposure or scanning platforms, Element actively proves impact. We combine large-scale discovery with controlled exploitation to surface high-impact, exploitable security issues across modern environments.

Role Overview

We are looking for a Senior Security Researcher to take a leading role in the design, development, and evolution of validation modules within our exploitation engine.

This is a hands-on research role focused on real vulnerabilities, real systems, and real-world exploitation logic, not theoretical analysis or report-only work. You will own research areas end-to-end: from vulnerability analysis, through exploitability validation, to production-grade automation that runs safely at scale.

You will work closely with other senior researchers and platform engineers, help shape research direction, and raise the bar on how exploitation-driven security validation is done.

Key Responsibilities

• Take part in the research, design, and implementation of validation and exploitation modules within Element’s exploit engine
• Analyze newly disclosed vulnerabilities and determine practical exploitability in real environments
• Translate manual exploitation techniques into safe, reliable, automated validation logic
• Own exploit modules throughout their lifecycle: research -> PoC -> production -> maintenance
• Collaborate closely with engineering teams to ensure modules are scalable, safe, and resilient
• Improve exploitation accuracy, reduce false positives, and harden validation logic against edge cases
• Document exploit chains, assumptions, limitations, and internal methodologies clearly
• Contribute to internal knowledge sharing and research standards

Required Qualifications

• 3+ years of hands-on experience in security research, penetration testing, exploit development, or application security
• Strong understanding of web application vulnerabilities, attack surfaces, and exploitation techniques
• Proven ability to reason about real-world exploitability, not just vulnerability existence
• Strong proficiency in Python (preferred) or another scripting language used for automation
• Experience writing production-quality research code, not just throwaway PoCs
• Deep familiarity with common tools such as Burp Suite, Nmap, custom scripts, and debugging workflows
• Solid understanding of OWASP Top 10, common misconfigurations, and modern web stacks
• Ability to clearly explain exploit mechanics, impact, and reproduction steps, verbally and in writing

Nice to Have

• Experience building or maintaining automated exploitation and validation frameworks
• Hands-on exploit development experience, including reliable proof-of-concept creation beyond basic vulnerability triggering
• Bug bounty experience with validated, high-impact findings
• Contributions to open-source security tooling or published security research
• Experience designing or experimenting with agentic or semi-autonomous exploitation workflows (e.g., chaining discovery, reasoning, and validation logic)
• Advanced certifications (OSWE, OSED, OSEE, etc.)

Personal Qualities

• Strong analytical mindset and structured problem-solving approach
• High attention to detail, especially when validating exploitation logic
• Comfortable owning complex problems end-to-end
• Able to balance research creativity with engineering discipline
• Clear communicator who can explain technical findings to engineers and security teams
• Curious, self-driven, and motivated to continuously improve research depth

Why Element

• Work on real-world exploitation and automated validation across large-scale attack surfaces
• Direct impact on how organizations prioritize and fix security issues
• Close collaboration between research and engineering
• Opportunity to shape how exploitation-driven security validation is done at scale
• A team that values deep technical work, not checkbox security