SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Semgrep is seeking a Senior Security Researcher to join its security research team and help shape the future of code security. You'll set your own research direction and work directly with customers to ship research to security teams worldwide, making impact beyond traditional product shipping.
You'll have access to a vast corpus of real-world code to validate ideas, a program analysis team building the underlying engine, frontier AI models and compute for experimentation, and a platform to publish to one of the largest security audiences globally. Your work will blend application security, program analysis, and applied AI to improve customer and community security.
Key responsibilities include: designing and shipping security workflows that combine deterministic analysis (taint, reachability, static slicing) with LLM reasoning to find real vulnerabilities across languages and frameworks; engineering agentic pipelines and prompts that are precise, cost-aware, and trustworthy; pushing on hard problems in automated triage and validation; building evaluation loops grounded in real customer codebases; encoding security judgment into reusable, versioned tooling; learning new languages, frameworks, and technologies quickly; prototyping new products in partnership with Engineering and Product; publishing research, giving talks, and representing Semgrep to the security community; and leading research planning with measurable impact.
You'll work across Semgrep's product suite including Semgrep Code (SAST engine), Semgrep Workflows (security automation platform), Semgrep Guardian (AI-generated code security), and Semgrep Multimodal (AI reasoning with rule-based detection). The core challenge is making automated detection trustworthy by grounding it in real program analysis so findings are reproducible and traceable to code evidence.
Semgrep is founded in San Francisco and backed by top-tier VCs including Menlo Ventures, Felicis, Lightspeed, Redpoint, and Sequoia. The company is recognized by Gartner in Application Security Testing and trusted by organizations like Vanta, Lyft, and Dropbox.
