# Security Researcher at Strix > Onsite · United States · Unspecified · Security · open. Source: https://alderhq.app/jobs/ashby%3Astrix%3Ad4c2d374-b627-46ae-bc54-d286884236c8 (read 2026-11-12). ## Facts (observed) - Company: [Strix](https://alderhq.app/companies/strix) - Location text: New York; San Francisco - Where it can be done from (inferred): Onsite · United States (evidence: "Location: New York; San Francisco") - Posted: 2026-08-24 (79 days ago) - First seen by alder: 2026-11-07 · last verified: 2026-11-07 - Reposted: 0 times · edited: 0 times - Apply on the employer's site: https://jobs.ashbyhq.com/strix/d4c2d374-b627-46ae-bc54-d286884236c8 - Skills listed (inferred): Python ## Pay and sponsorship - Posted pay: not posted - Market band for similar posted roles (New York, n 70): p25 $129k, median $198k, p75 $251k ## Description (the employer's text) ### About Strix We believe that software is the foundation of modern civilization, yet vulnerabilities threaten its integrity, security, and resilience. Strix is on a mission to solve security. Strix builds autonomous AI penetration testing agents that think like attackers: discovering, validating, and helping fix real vulnerabilities across live applications, codebases, and infrastructure, continuously, not once a year. We are looking for strong technical people who want to work at the intersection of AI, security, and infrastructure. ### About this role We're looking for a Security Researcher to push the frontier of what our AI agents can find. You will hunt for real vulnerabilities, turn your offensive-security expertise into agent skills, benchmarks, and detection strategies, and validate that Strix finds what matters in real-world targets. ### You're excited about this role because you will… Discover and exploit vulnerabilities in web applications, APIs, cloud infrastructure, and open-source software Encode offensive-security techniques into agent behaviors, tools, and playbooks that scale your expertise Build and curate vulnerable environments and benchmarks that measure real agent capability Analyze agent findings, separate signal from noise, and drive the false-positive rate toward zero ### Qualifications 3+ years of hands-on offensive security experience (penetration testing, red teaming, bug bounty, or vulnerability research) Deep understanding of web application security, exploitation techniques, and modern attack surfaces Programming experience in Python or similar; comfort building your own tooling CVEs, published research, CTF results, or a strong bug bounty track record are a plus A tendency to leave things in a better way than you found them ### What we offer Competitive salary with meaningful equity Health, vision, and dental insurance Office lunch and dinner (when working from our New York office) Strix is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. To all recruitment agencies: Strix does not accept agency resumes. Please do not forward resumes to Strix employees. Strix is not responsible for any fees related to unsolicited resumes and will not pay fees to any third-party agency or company that does not have a signed agreement with the Company. --- Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/ashby%3Astrix%3Ad4c2d374-b627-46ae-bc54-d286884236c8 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.