Security Researcher
About Echo Echo delivers frontier-hardened software across the enterprise software supply chain. Echo's containers, libraries, OS packages, VMs, and more are built and patched from source by agentic pipelines, and continuously vetted for supply chain threats. With us, developers and agents can build with secure-by-default software that's compatible with the tools and versions they already use.
We're now looking for a Security Researcher to take ownership of our biggest challenges: vetting our libraries, and driving the end-to-end process of our vulnerability research product, from finding and patching to disclosure.
What you’ll do
- Own Echo’s vetting mechanisms for malicious packages, so that our customers stay safe from supply chain attacks
- Build and maintain AI agents that find, validate, and patch vulnerabilities across distros and language ecosystems, using frontier models
- As a CNA, drive CVE disclosure end to end, from PoC and maintainer coordination to publication
- Deep-dive into high-impact CVEs and upstream patches in C/C++ codebases
- Stay on top of emerging threats and share our research externally through blog posts, write-ups, and talks, and support marketing with technical expertise
- What you bring
Required
4+ years of hands-on experience in security research or vulnerability analysis
Understanding of C/C++ codebases
Understanding of software supply chain attacks, such as malicious packages and backdoors, dependency risks, and common attack vectors and techniques
Understanding of offensive security techniques, attack surfaces, and common exploitation methods
Clear communication and the ability to work effectively across teams
Preferred
- Deep knowledge of CVEs: vulnerability classes, CVSS, advisories, and how fixes flow from upstream to distros
- Hands-on vulnerability research experience, such as finding 0-days, fuzzing, or exploit development
- Experience working with AI tools and methodologies in security research contexts
- Experience publishing research: blog posts, talks, discovered CVEs, or open-source security projects
Every role in the library, ranked against your CV.
Rewritten from your real, matching experience for the job you pick.
Your whole pipeline in one place, with a fresh move every morning.
