About the Role

We're looking for a Principal Security Researcher to own and drive the cybersecurity research agenda that powers our unified vulnerability management platform. This is a deeply technical, hands-on, senior individual contributor role that sits at the intersection of product, research, and engineering.

You will be our resident Subject Matter Expert on vulnerabilities and remediation — the person who brings the cyber vision into the product. You'll translate emerging attacker and defender trends into concrete product theses, validate them through hands-on POCs, and partner with our Data Scientists and Engineering teams to turn those theses into shipped capabilities. Where Product defines the "what" and Engineering executes the "how," you own the critical middle layer: how should this work, is it feasible, and what does the data actually tell us.

This role is central to building Onit's proprietary IP — the core research that differentiates us in the market. You'll also be one of the public faces of that IP, representing Onit's thinking at industry conferences and through technical content.

This role sits within Product Research, reporting directly to the CPO, and works closely with Data Science, Engineering, and Product leadership.

What You'll Do

The role breaks into four main areas of focus:

1. Cyber Research & Product Thesis Validation (~50%)

Own the cybersecurity research agenda that feeds our product roadmap — from asset criticality and ownership detection to vulnerability prioritization, exposure grouping, and remediation automation
Bring original, creative ideas for how to solve customer problems using the signals available in our unified data plane (CrowdStrike, Wiz, Qualys, Tenable, ServiceNow, CMDBs, and more)
Validate product theses through hands-on POCs before engineering commits — prove or disprove feasibility quickly
Partner with our Data Science team as their cybersecurity domain expert, guiding them on which signals matter, how to interpret findings, and where to look next
Stay current on the evolving vulnerability, attacker TTP, and defensive tooling landscape, and translate it into product value
Represent the voice of cybersecurity in product discussions and help Product leadership make informed prioritization decisions

2. Integration Lab & Partner Product Research (~20%)

Stand up and configure partner and competitor products (vulnerability scanners, EDR, CNAPP, ASPM) in lab environments to support integration research and validation
Build end-to-end validation flows — e.g., deploy a vulnerable workload, scan it with Tenable/Qualys, remediate, re-scan, confirm closure — so our platform's automation can be tested against real signals
Comfortable across IT, DevOps, and Security fundamentals — you can install, configure, and integrate unfamiliar security products

3. Customer Data Analysis & Action Center Insights (~20%)

Go through real customer vulnerability data to extract insights, identify patterns, and produce actionable recommendations that feed our Action Center
Research what constitutes a "critical asset" across different customer environments and translate that into detection logic
Use the insights from manual analysis to inform the next wave of automation — your hands-on data work today becomes the algorithm tomorrow

4. Market Presence & Thought Leadership (~10%)

Identify relevant cybersecurity conferences (RSA, Black Hat, DEF CON, BSides, Gartner Security & Risk, industry meetups) and submit Call-for-Papers proposals based on Onit's research and perspective
Deliver technical talks that position Onit as a thought leader in vulnerability management and AI-driven security operations
Author technical blog posts on our site based on findings from customer data, new research, and our unique take on the UVM space
Publish LinkedIn technical posts that build Onit's voice in the security community
Partner with Marketing on content calendar and messaging

Requirements

7+ years of cybersecurity experience across vulnerability management, offensive security, security engineering, or a combination
Ideal background includes time as a VM analyst or as part of an enterprise vulnerability management program — you've lived the day-to-day of triaging, prioritizing, and driving remediation at scale
Broad, across-the-board cyber defense knowledge — you understand how the pieces fit together rather than being narrow in one niche
Generalist security engineering experience is a strong fit — someone who has worn multiple hats (IT, infrastructure, security tooling, detection) and can operate across domains
Deep domain expertise in vulnerabilities and remediation — from both offensive and defensive perspectives
Proven ability to see the big picture: take an ambiguous, open-ended problem ("how do we identify critical assets?") and drive it to a validated answer without waiting for someone to spec it out
Genuinely creative problem-solver — you bring ideas, not just execution
Self-driven and impact-oriented— you own your outcomes, measure your own impact, and thrive with minimal supervision in ambiguous problem spaces
Strong hands-on technical skills: comfortable standing up labs, working with APIs, scripting (Python, Bash), and spinning up tools you've never used before
Experience working closely with a product organization — you understand how to think in terms of customer value, flows, and stickiness, not just technical depth
Excellent written and verbal communication — you can translate between cyber, data science, engineering, and executive audiences, and are comfortable publishing and speaking publicly
Thrives in a fast-moving early-stage startup environment

What This Role Is Not

To set expectations clearly, this role is distinct from several other "security researcher" profiles. We are not primarily looking for:

A malware researcher / reverse engineerwhose focus is analyzing malware samples to produce IoCs, signatures, or threat-intelligence feeds
A vulnerability researcher / bug hunterwhose focus is discovering net-new vulnerabilities (0-days), fuzzing, or CVE discovery in software
An offensive specialist / pentester / red-teamerwhose focus is exploiting and breaking into systems —though offensive expertise will not disqualify a candidate who also brings the VM-program, defensive-breadth, and product-research strengths described above

Our work centers on the defender's side of vulnerability management at scale — prioritization, asset context, remediation, and turning messy enterprise data into automated decisions.

Technical Skills

Hands-on familiarity with leading vulnerability and security tooling: Tenable, Qualys, CrowdStrike (Spotlight + EDR), Wiz, ServiceNow, or equivalents
Comfortable across IT, DevOps, and Security fundamentals — you can install, configure, and integrate unfamiliar security products
Data analysis skills — you can write SQL, work with dataframes, and explore large datasets to test a hypothesis
Experience leveraging modern AI/LLM tools (Claude, ChatGPT, Cursor) to accelerate research and reduce grunt work
Understanding of enterprise security operations — how SOCs, vulnerability management programs, and remediation workflows actually run day-to-day

Nice to Haves

Experience in an "Office of the CTO," Advanced Research, or similar forward-looking technical role at a security or infrastructure company
Background spanning multiple security domains (network, endpoint, cloud, identity, application)
Published research, prior conference talks (Black Hat, DEF CON, RSA, BSides), or open-source contributions
Active technical writing presence (personal blog, LinkedIn, industry publications)
Experience building or contributing to commercial security products
Familiarity with frameworks like MITRE ATT&CK, NIST CSF, NIST 800-53, or CIS Controls
Prior experience at an early-stage cybersecurity startup