About GitGuardian
GitGuardian is a global cybersecurity scale-up based in Paris, New York City, and Boston. Early investors include GitHub co-founder Scott Chacon, Docker co-founder Solomon Hykes, and top-tier American and European VC firms. The company raised its Series C in early 2026.
GitGuardian helps enterprises close credential-based breach paths by finding secrets wherever they live, prioritizing remediation with rich context, and preventing new exposure across code, systems, and AI. The platform is used by more than 600,000 developers worldwide and by 50 of the Fortune 500.
About Your Team and Mission
We are seeking a highly skilled and motivated senior security researcher to join our team and focus on security challenges related to secrets in the new world of agentic AI.
You will join the cybersecurity research team, which brings backgrounds from CISO roles, red teaming, penetration testing, development, and vulnerability research. Team members have recently participated in major conferences such as Real World Crypto, SSTIC, Black Alps, Northsec, and KubeCon.
Day-to-day responsibilities
- Investigate novel and existing tactics to find and abuse exposed credentials, then publish findings as authoritative research
- Analyze ongoing threats and attacks, explore new exploitation techniques, and document emerging tactics
- Collaborate with engineering teams to improve products in terms of secret validation and coverage
- Track offensive trends and techniques
- Work closely with marketing to produce 2–3 technical deep-dive articles or talks per quarter (recent publications on our security research blog)
Role composition: roughly 70% research, 30% content production for the security community.
Collaboration: cross-functional expertise in cybersecurity, software development, and data analysis; close work with internal Security team; report to the cybersecurity research lead.
About You
If you match at least 70% of the criteria below, please apply.
Essential
- 5+ years in a security engineer role, with 2+ years dedicated to research-related work (or equivalent)
- Strong offensive security background (pentesting, vulnerability research, or red team experience) with ability to think like an attacker and translate that into defensive insights
- Experience with reverse engineering (binary analysis, malware inspection, malicious packages) and API/web security (OAuth, JWT, token validation, secret exposure patterns)
- Comfortable working with modern infrastructure: cloud platforms (AWS, GCP, or Azure) or AI/LLM ecosystems, and able to assess their specific security implications
- Actively leverage AI tools in day-to-day research workflow (automation, analysis, prototyping)
- Proficient in at least one system or scripting language (Python, Go, or Rust), fluent with a terminal, and able to independently retrieve, transform, and analyze datasets to support research conclusions
- Track down complex security problems in software and infrastructure and define their solutions
- Enjoy hacking things and rapidly prototyping ideas
- Drive research autonomously: identify topics, conduct investigations, publish findings, and partner with engineering and product teams to translate insights into platform improvements
- Public research track record: CVEs, conference presentations, open-source tooling, or technical publications
- Fluent in English (written and spoken) with strong communication skills: explain complex vulnerabilities clearly to both technical and non-technical audiences and present at international conferences
Preferred (not required)
- Understand supply chain security, including how attacks propagate through package registries (npm, PyPI, DockerHub), GitHub Actions workflows, and dependency automation tools
- Experience monitoring ongoing attacks, correlating signals across multiple data sources, reconstructing breaches, and publishing findings to the security community
Interview Process
We are committed to building a diverse, equitable, and inclusive workforce. We ask for gender on the application page to track diversity progress; this information is optional, not disclosed to the hiring team, and not considered in hiring decisions.
- First Screening Call (Virtual) – Discover your professional project and evaluate mutual fit.
- Interview with Your Future Manager – Walk through your offensive security background and how you take research from idea to published finding.
- Technical Test / Research Case (2 sessions × 60 min)
- First session (Engineering focused) – Example tasks: parsing a dataset of potential secret exposures, building a detector for a specific credential type, or investigating an internal security incident from telemetry data.
- Second session (Research focused) – Example tasks: investigating a credential leak by digging into source code and CI logs, then pivoting into cloud infrastructure using the exposed credentials.
- Meet the Team (Onsite) – On-site lunch with research and marketing team members.
- Final Interview with an Executive Member – Discuss company vision and ambitions for the next couple of years.
- References Check – Provide two recent professional contacts who can attest to your experience; we will call them at the end of the process.
Benefits
- Package that includes BSPCE
- Lunch voucher (Swile, €12 at 50%)
- Sponsored Wellpass (gymlib)
- Non-charged health insurance for children (Sidecare / Generali)
- Up to €300 to improve your home office set-up
- Yearly holiday allowance
- Referral bonus of €4,000 for any new Guardian hired thanks to you
- Team building: monthly budget per employee to spend with colleagues (examples: Michelin-star restaurant, karaoke, stand-up show, kitesurfing weekend)
- Remote policy: hybrid (3 days/week at the office in Paris)
- Opportunities for long-term career development
Imported from GitGuardian’s job posting on gitguardian.teamtailor.com. Apply sends you to the original listing.