Web Security Researcher
The full posting
We are looking to fill the position of a security researcher in our Web team. A person in this role will conduct server-side vulnerability research on Web Applications.
Responsibilities
- Help develop and carry out the Web team research strategy by conducting vulnerability research and exploit development on Web Applications.
- Provide unbiased insights and ideas to the web research team.
- Develop proof-of-concept code and exploits.
- Remain on top of various developments related to Web Technologies such as security mitigations, new features, exploitation techniques, etc.
Requirements
- Track record of finding impactful server-side vulnerabilities (e.g. Auth Bypass, RCE, User to Admin PE) in Web Applications.
- An understanding of web protocols and web architectures.
- Ability to manually detect and exploit common web vulnerabilities.
- Ability to conduct long-term and widely scoped security research projects as part of a broader team effort.
- Stay up to date with emerging trends of web app security and research methods.
- Exploitation experience is a plus, but not required.
What we offer
- Finance: Highly competitive compensation package with an additional monetary bonus system based on exploitable vulnerability findings.
- Career Development: Further your career by joining a team of established and experienced security researchers.
- Work Environment: Fully remote with flexible work schedule.
- Off-topic Research: We allow researchers, at their discretion, to spend up to 15% of their time conducting research on other topics.
- Wellness: We offer a prime wellness program designed to promote a healthy lifestyle, which includes, but not limited to access to gyms around the world, health coaching, and more.
For more information, please review our Recruitment Policy at https://dfsec.com/recruitment-policy-en
Where you can be based
This position is 100% remote and open to applicants anywhere in the world.
Text as Dataflow Security published it; last compared with the original on 13 Nov 2026.
The application
Your details, then 1 question.
- 1.Website / Git or other code repositoryShort answer · optional
Taken from Dataflow Security's application form as it stood on 13 Nov 2026.
The employer: Dataflow Security
Researches vulnerabilities and builds exploits for vetted government agencies, and is hiring researchers for Android, iOS, browser and web targets.
Pay and benefits: Research staff roles producing exploits and proof-of-concept code to the company's own quality standard.
Other security roles worth a look
A few links on CyberJobs.cc are referral links: when one leads to a hire, a sign-up or a purchase (a lab, a course or a tool marked Partner), the company behind it may pay CyberJobs.cc a fee. You pay nothing extra, and it never changes the salary an employer offers you or which roles the board lists. Roles from partners who pay us a fee rank a little higher in this list.
Application Security Engineer – CVE & Vulnerability Research (shows the role here)
Anyone AI · Offensive Security · Remote· 1mo agoDetails
$65/hr
Security Platform and Vulnerability Management Specialist (shows the role here)
Instructure · Security Engineering · Budapest, Hungary· 6d agoDetails
Security Researcher (shows the role here)
Wiz · Threat Intel & Research · Tel Aviv· 5mo agoDetails
Security Research (shows the role here)
Transmit Security · Threat Intel & Research · Tel Aviv-Yafo, Gush Dan, Israel· 1mo agoDetails
A proven pentester or red teamer?
Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.
Hear first when Dataflow Security posts a security role
We read Dataflow Security's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.