QU
QualysLead Security Research Engineer
Read straight from Qualys's careers page, verified 1d ago.Seekless can tailor your résumé to it.
Seekless can write your résumé for this posting first.
Before you apply
LocationPune
Typefull-time
SeniorityLead
Experience8+ yrs
Company size1,001–5,000 people
PostedJul 28, 2026 · 3mo ago
Verified live1d ago
At a glanceSummarised by Seekless from the posting.
Bachelor's degree in a relevant field (or equivalent experience)
8+ years of hands-on experience in vulnerability research, penetration testing, detection engineering, or security research
Deep understanding of TCP/IP, HTTP/HTTPS, FTP, SSH, SMTP, DNS, SSL/TLS, and modern web protocols
Strong expertise in vulnerability analysis, exploit development, and attack techniques
Extensive knowledge of operating systems, databases, web technologies, cloud environments, and enterprise infrastructure
Strong coding background
Experience with packet analysis, network troubleshooting, and protocol reverse engineering
Knowledge of OWASP Top 10, common attack techniques, and modern threat actor tactics
Excellent written, verbal, and technical communication skills
Demonstrated experience leading projects and mentoring technical teams
Understanding of Lua (preferred), Bash, or Python
Knowledge of Cloud Platforms (AWS, Azure, Oracle, etc.)
Proficient with regular expressions
Knowledge of container technologies such as Docker and Kubernetes
Experienced in the use of vulnerability scanners, IDS, and security tools
OSCP, CISSP, or SANS GIAC certifications
Skills
TCP/IP
HTTP/HTTPS
FTP
SSH
SMTP
DNS
SSL/TLS
Lua
Bash
Python
AWS
Azure
Oracle
Docker
Kubernetes
About the company
Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!
About the role
As a Lead Security Research Engineer, you will provide technical leadership for vulnerability research, exploit analysis, exposure validation, and vulnerability signature development across the Qualys security platform. You will lead initiatives to identify, validate, and prioritise security risks based on real-world exploitability, helping customers distinguish theoretical exposures from confirmed attack paths.
Responsibilities:
•
Lead vulnerability research initiatives across operating systems, databases, enterprise applications, cloud services, container platforms, and network devices.
•
Research newly disclosed, N-day, and actively exploited vulnerabilities.
•
Lead the development of exploit-based exposure validation techniques to confirm real-world exploitability of vulnerabilities.
•
Review technical designs, research methodologies, and code contributions to ensure quality and consistency.
•
Partner with Engineering and Product teams to influence roadmap decisions and security content strategy.
•
Design safe and controlled validation mechanisms that emulate attacker behavior without affecting production systems.
•
Analyze vulnerability root causes, attack vectors, exploitability conditions, and potential business impact.
•
Mentor and guide Security Research Engineers on vulnerability analysis, exploit analysis, and signature creation.
•
Build validation logic capable of determining whether existing security controls such as WAFs, firewalls, EDRs, IPS, and compensating controls effectively prevent exploitation.
•
Drive automation initiatives for vulnerability research, exploit validation, content generation, testing, and release processes.
•
Establish best practices, coding standards, and quality guidelines for signature development.
Qualifications:
•
Bachelor’s degree in a relevant field (or equivalent experience).
•
8+ years of hands-on experience in vulnerability research, penetration testing, detection engineering, or security research.
•
Deep understanding of TCP/IP, HTTP/HTTPS, FTP, SSH, SMTP, DNS, SSL/TLS, and modern web protocols.
•
Strong expertise in vulnerability analysis, exploit development, and attack techniques.
•
Extensive knowledge of operating systems, databases, web technologies, cloud environments, and enterprise infrastructure.
•
Strong coding background.
•
Experience with packet analysis, network troubleshooting, and protocol reverse engineering.
•
Knowledge of OWASP Top 10, common attack techniques, and modern threat actor tactics.
•
Excellent written, verbal, and technical communication skills.
•
Demonstrated experience leading projects and mentoring technical teams.
Additional Plus Competencies:
Understanding of Lua (preferred), Bash, or Python.
Knowledge of Cloud Platforms (AWS, Azure, Oracle, etc.).
Proficient with regular expressions.
Knowledge of container technologies such as Docker and Kubernetes.
Experienced in the use of vulnerability scanners, IDS, and security tools.
OSCP, CISSP, or SANS GIAC certifications.