What are the responsibilities and job description for the CVE Analyst position at Semgrep?
About the role
As a CVE Analyst at Semgrep, you’ll help us build a new category of developer focused security tools to prevent security vulnerabilities. You will be joining the team that builds Semgrep Supply Chain, a high-signal dependency scanner that cuts through the noise of false positives by leveraging Semgrep’s first party code analysis. In this role, you will research open source vulnerabilities and write Semgrep rules to help secure our customers against the latest threats.
Along the way, you will work with a dedicated group of full stack developers, security researchers, program analysis experts, and infrastructure engineers. You will learn from senior security researchers who bring experience and wisdom from years running AppSec programs, working as security consultants, and discovering new CVEs. You will work with our clients’ security teams at companies ranging from early-stage startups to social-media giants, learning about their security philosophies. You’ll attend lunch and learns across the company - learning about everything from advanced type systems to product paradigms. As a CVE Analyst, you will get to talk directly to real customers who are using the rules you write - something that makes working at an early-stage startup unique!
You will:
- Research new vulnerabilities and understand what makes them dangerous
- Write rules to protect customers from emerging threats
- Improve automation to make it easier to write high quality rules
- Use data to understand the performance and quality of our rules
- Collaborate with the team through code reviews, design discussions, and demos
- Learn from a mentor whose job is to help you succeed
- Present your work to the team
You are ideal for this role if you:
- Know how to read and write code
- Know what a CVE is
- Are excited to learn more about securing code
- Are interested in making a career in application security or security research
What we offer
- $40/hour, with an expectation of 40 hours of work per week
- Flexible length contract (minimum 6 months) with the opportunity to convert to full time
- Close 1:1 mentorship from full time security researchers
- The option to work in-person in our San Francisco, New York, and Boston office or to work remotely in North America time zones
Salary : $40 - $0