About Echo

Echo delivers frontier-hardened software across the enterprise software supply chain.

Echo's containers, libraries, OS packages, VMs, and more are built and patched from source by agentic pipelines, and continuously vetted for supply chain threats. With us, developers and agents can build with secure-by-default software that's compatible with the tools and versions they already use.

We're now looking for a Security Researcher to take ownership of our biggest challenges: vetting our libraries, and driving the end-to-end process of our vulnerability research product, from finding and patching to disclosure.

What you’ll do

Own Echo’s vetting mechanisms for malicious packages, so that our customers stay safe from supply chain attacks

Build and maintain AI agents that find, validate, and patch vulnerabilities across distros and language ecosystems, using frontier models

As a CNA, drive CVE disclosure end to end, from PoC and maintainer coordination to publication

Deep-dive into high-impact CVEs and upstream patches in C/C++ codebases

Stay on top of emerging threats and share our research externally through blog posts, write-ups, and talks, and support marketing with technical expertise

What you bring

Required

4+ years of hands-on experience in security research or vulnerability analysis

Understanding of C/C++ codebases

Understanding of software supply chain attacks, such as malicious packages and backdoors, dependency risks, and common attack vectors and techniques

Understanding of offensive security techniques, attack surfaces, and common exploitation methods

Clear communication and the ability to work effectively across teams

Preferred

Deep knowledge of CVEs: vulnerability classes, CVSS, advisories, and how fixes flow from upstream to distros

Hands-on vulnerability research experience, such as finding 0-days, fuzzing, or exploit development

Experience working with AI tools and methodologies in security research contexts

Experience publishing research: blog posts, talks, discovered CVEs, or open-source security projects