Senior Security Researcher

About Spikerz

Spikerz secures enterprises’ external digital assets, protecting business accounts, privileged access and brand presence across platforms beyond the corporate perimeter.

AI-powered attacks, compromised identities and ungoverned automation create new paths to account takeover and brand compromise. Spikerz combines enterprise-grade access governance with real-time threat detection and response to defend this expanding attack surface.

About the role

Discover the attacks Spikerz does not yet cover—and shape the capabilities that will stop them.

This role combines 50% hands-on security research and 50% product discovery and definition. You’ll uncover emerging attack paths, challenge existing protection assumptions and turn validated findings into product requirements, working closely with Product, Engineering and AI teams.

What you’ll do

Security research — 50%

• Discover and reproduce attack chains involving account takeover, phishing, session abuse, recovery mechanisms and third-party access.
• Expose protection gaps and product edge cases across account types, permission hierarchies, linked assets and undocumented platform behavior.
• Investigate AI-enabled threats, including prompt injection, excessive agent permissions and abuse of connected tools, using reproducible proofs of concept and adversarial experiments.

Product discovery — 50%

• Turn research into protection capabilities, defining customer problems, detection opportunities, response requirements and measurable acceptance criteria.
• Influence roadmap priorities through evidence of attack feasibility, customer exposure, security impact and implementation constraints.
• Validate that delivered capabilities close the original attack path, partnering with Engineering, AI and QA on prototypes, evaluations and regression scenarios.

What you bring

• 8+ years in security research, threat research, vulnerability research or abuse analysis, with evidence of independently discovering and validating attack paths.
• Experience in a cybersecurity product company, with a clear understanding of how research translates into customer protection.
• Strong knowledge of Web and API security, authentication, OAuth, sessions, account recovery and authorization models.
• Hands-on investigation skills using Python, browser developer tools, network analysis, browser automation and API reverse engineering.
• Strong product judgment: ability to define problems, prioritize opportunities and write actionable requirements.
• Understanding of AI and agent security, including untrusted content, tool permissions, adversarial testing and evidence-based evaluation.

An advantage

Experience researching social platforms, business account ecosystems, brand impersonation, advertising abuse or MCP-connected agents.

Why Spikerz?

Discover new threats, directly influence the product roadmap and turn your research into defenses used by global brands.