Security Researcher

About Echo

Echo delivers frontier-hardened software across the enterprise software supply chain.
Echo's containers, libraries, OS packages, VMs, and more are built and patched from source by agentic pipelines, and continuously vetted for supply chain threats. With us, developers and agents can build with secure-by-default software that's compatible with the tools and versions they already use.

We're now looking for a Security Researcher to take ownership of our biggest challenges: vetting our libraries, and driving the end-to-end process of our vulnerability research product, from finding and patching to disclosure.

What you’ll do

• Own Echo’s vetting mechanisms for malicious packages, so that our customers stay safe from supply chain attacks

• Build and maintain AI agents that find, validate, and patch vulnerabilities across distros and language ecosystems, using frontier models

• As a CNA, drive CVE disclosure end to end, from PoC and maintainer coordination to publication

• Deep-dive into high-impact CVEs and upstream patches in C/C++ codebases

• Stay on top of emerging threats and share our research externally through blog posts, write-ups, and talks, and support marketing with technical expertise

What you bring

Required:

• 4+ years of hands-on experience in security research or vulnerability analysis

• Understanding of C/C++ codebases

• Understanding of software supply chain attacks, such as malicious packages and backdoors, dependency risks, and common attack vectors and techniques

• Understanding of offensive security techniques, attack surfaces, and common exploitation methods

• Clear communication and the ability to work effectively across teams

Preferred:

• Deep knowledge of CVEs: vulnerability classes, CVSS, advisories, and how fixes flow from upstream to distros

• Hands-on vulnerability research experience, such as finding 0-days, fuzzing, or exploit development

• Experience working with AI tools and methodologies in security research contexts

• Experience publishing research: blog posts, talks, discovered CVEs, or open-source security projects