Vulnerability Researcher (f/m/d)

Overview

Sonar helps prevent code quality and code security issues from reaching production, amplifies developers\‘ productivity with AI assistants, and improves the developer experience with streamlined workflows. Sonar analyzes all code, regardless of authorship, to produce more secure, reliable, and maintainable applications. Sonar supports over 30 programming languages, frameworks, and infrastructure technologies and is trusted by millions of developers worldwide, including teams at the DoD, Microsoft, NASA, MasterCard, Siemens, and T-Mobile.

We believe in developing great products with a strong internal culture. We are committed to and obsessed with the company, users, each other, and the open source community. At Sonar, CODE is a mindset that defines daily operations.

Why You Should Apply: we are a group of professionals working to help supercharge developers to build better, faster. Our solutions focus on reducing developer toil by fixing issues at the source for all code, whether developer-written, AI-generated, or from third parties.

We have a dynamic, global culture with hub offices in the USA, Switzerland, the UK, Singapore, and Germany, and flexible work arrangements depending on location.

The Impact You Will Have

We are seeking a Vulnerability Researcher who loves discovering 0-day vulnerabilities in open-source code and advancing our code analysis technology. You will be part of the Code Security Department and help provide the best code analysis solution on the market. By sharing security research and findings with a worldwide community, you will help developers write secure code.

What You Will Do Daily

• Collaborate with world-class security enthusiasts who share a passion for web security.
• Uncover, discuss, exploit, and report critical and complex vulnerabilities in popular open source web applications.
• Research new and existing vulnerability types and exploitation techniques.
• Automate the detection of vulnerabilities in well-known applications using our code analysis technology.
• Share research with the global community via blog posts or presentations at international conferences.

Experience You Will Need

• 3+ years of experience reviewing source code for critical security vulnerabilities.
• Deep understanding of major security vulnerability types, how to spot them in code, and how to exploit them with different techniques.
• Solid programming skills in Java, C#, Python, or JavaScript.
• Creative and persistent mindset when auditing new source code; ability to think outside the box.
• Commitment to professional and responsible disclosure of vulnerabilities to affected vendors.
• Fluency in English, with the ability to explain complex security concepts clearly.

Why You Will Love It Here

• Dynamic culture that values respect, kindness, and the right to fail and recover quickly.
• People-focused environment that balances technical excellence with collaboration and leadership in our domains.
• Flexible work policy with in-office and remote options depending on location.
• Growth mindset with opportunities to learn new skills as the industry evolves.
• Strong internal teams supporting product leadership and execution.
• Transparent communication and regular updates on growth and success.

Benefits of Working with Sonar

• Pension schemes and retirement benefits, with specifics provided by location.
• Generous paid time off and holiday policies aligned with regional norms.
• Public transport reimbursement and global workforce across 20+ countries and 35+ nationalities.
• Annual company kickoff events to build relationships and goals.

We Value Diversity, Equity, and Inclusion

We are an equal opportunity employer and value diverse backgrounds, perspectives, and cultures. We are committed to creating an inclusive environment where everyone can contribute their best. All offers are contingent on a comprehensive background check and reference verification before the start date. We do not currently support visa candidates in the US. Applications submitted through agencies or third-party recruiters will not be considered. We may use AI tools to support parts of the hiring process, but final hiring decisions are made by humans. For more information about data processing, please contact us.

#J-18808-Ljbffr