Senior Security Researcher

About this role

Company Background

Censys’ mission is to be the one place to understand everything on the internet. Frustrated by the lack of trustworthy Internet intelligence, we set out to create the industry’s most comprehensive, accurate, and up-to-date map of the Internet. Today, Censys delivers real-time Internet intelligence and actionable threat insights to global governments, over 50% of the Fortune 500, and leading threat intelligence providers worldwide.

As a Security Security Researcher, you’ll have the opportunity to work at the intersection of large-scale internet measurement, advanced threat research, and real-world cybersecurity events. Our research doesn't just advance academic knowledge—it’s leveraged to directly protect enterprise customers and support critical national security initiatives. You'll collaborate with world-class researchers, engineers, and product teams while having the freedom to pursue ambitious research projects that push the boundaries of what's possible in cybersecurity. With our strong partnerships across government and commercial sectors, your work will have immediate real-world application and visibility at the highest levels of the security community.

We're looking for a Security Researcher with deep, hands-on offensive security experience — penetration testing, red teaming, adversary emulation, CNO — to join our Research team, known as ARC. This is a role that generates original, attacker's-eye insight and turns it into both product capability and public research.You'll work at the intersection of three things: how real attackers operate, what that means for how Censys should scan, fingerprint, and characterize the Internet, and how to communicate that to both engineering teams and the broader security community.

This position is located remotely with no expectation to work from a Censys office. This position is also expected to travel once per quarter for industry events and team onsites.

What you’ll do:

• Drive product capability. Bring an offensive practitioner's perspective to Censys's scanning, fingerprinting, and attack surface data. Identify gaps in detection logic, protocol coverage, and vulnerability signals that only someone who has actually broken into networks would notice.

• Conduct original research. Investigate emerging attack techniques, exploitation trends, C2 infrastructure, and adversary tradecraft using Internet-wide scan data and your own testing methodology.

• Publish seminal work. Produce research reports, technical blog posts, and conference-caliber material (DEF CON, Black Hat, BSides, etc.) that establishes Censys as an authoritative voice in offensive security.

• Collaborate cross-functionally. Partner with Engineering and Product to translate research findings into new scanning modules, fingerprints, risk indicators, and detection features.

• Lead agentic AI threat research. Build, deploy, and evaluate agentic AI frameworks — autonomous penetration testing agents, LLM-powered vulnerability research tools, multi-agent swarms — both as tradecraft research (i.e., “how do attackers use these tools”) and as Censys product capability (i.e., “how do we detect that adversaries are using them”). Where AI-assisted vulnerability discovery shows promise, determine what Censys’ scanning and fingerprinting posture should be for the signals those tools leave behind.

• Track adversary infrastructure. Use red team and pentest tradecraft knowledge to identify how threat actors stand up, configure, and hide infrastructure — and encode that knowledge into repeatable detection logic.

• Mentor and inform. Act as an internal subject-matter expert on offensive techniques, helping other researchers and engineers reason about attacker behavior.

• Demonstrates curiosity, a willingness to learn, and sound judgment in applying AI

Skills and experience you’ll have:

• 5+ years of hands-on penetration testing, red teaming, or adversary emulation experience against enterprise, cloud, or Internet-facing environments.

• Demonstrated ability to independently identify and characterize vulnerabilities, misconfigurations, or exploitation techniques.

• Strong understanding of network protocols, service fingerprinting, and Internet-scale scanning concepts (or a fast ability to pick them up).

• Hands-on experience with agentic systems for offensive security. You have built, evaluated, or operated LLM-powered attack agents using autonomous pentest frameworks such as: HackSynth, RedTeamLLM, CAI, PentAG, and successors; AI-assisted vulnerability research pipelines, or multi-agent adversary emulation tooling. You also have demonstrated understanding of the failure modes of this agentic tooling

• Proficiency in scripting or coding (Python, Go, or similar) to build tooling, automate testing, or analyze large datasets.

• Familiarity with red team frameworks and tradecraft (C2 frameworks, initial access techniques, living-off-the-land methods, evasion).

• Comfort working with large-scale Internet scan data or a strong interest in learning to do so.

Preferred skills/experience:

• Relevant certifications (OSCP, OSCE, OSEP, GXPN, or equivalent demonstrated skill).

• Experience with IoT, OT/ICS, or embedded device security research.

• Prior work as a researcher at a security vendor.

• Evidence of research/tooling contributions to the agentic offensive space (e.g., benchmarks, PoCs, AI-assisted vulnerability discoveries) and demonstrated agentic AI red teaming work (e.g., Microsoft's PyRIT, the Cloud Security Alliance's Agentic AI Red Teaming Guide, or equivalent tooling and methodology)

• A track record of public research output — CVEs, conference talks, technical blog posts, or tool releases — that shows you can communicate findings clearly to a technical audience.

• Familiarity with compliance-adjacent security testing (e.g., how pentest findings map to SOC 2, ISO 27001, or CMMC control requirements) is a plus, though not the core focus of this role.

You'

Similar jobs

• Senior Security Researcher — Human · Remote
• Senior Security Researcher — Clarityinnovates · USA
• Senior Security Research Scientist — Censys · Remote
• Senior Security Researcher (Red Team) — Pindropsecurity · Remote
• Senior Security Engineer — Gofundme · Remote
• Senior Security Engineer — Ardentmc · Washington, D.C. Metro - hybrid/remote
• Senior Security Engineer — Sigmacomputing · San Francisco, CA
• Senior Security Engineer — Pairteam · Remote