Socket
Threat Researcher at Socket
$126,000–$170,000 / year
Apply for this positionRole overview
An at-a-glance view of the facts included with this Threat Researcher at Socket listing.
- Company
- Socket
- Location
- Remote, United States
- Work arrangement
- Remote
- Employment type
- Full-time
- Compensation
- $126,000–$170,000 / year
Applications for this listing are submitted through CareersForge. Use the form on this page, then sign in to your Candidate Portal to follow application updates and any interview invitation.
Role overview
This job description has been rewritten in fresh language using the facts in the listing. Source credit and original listing details are available below.
Socket is hiring a full-time Threat Researcher for its Threat Intelligence Team. This remote role is based in the United States and focuses on software supply-chain threats, using Socket’s AI-based scanner and developing tools for malware analysis. The position is not entry-level and calls for hands-on threat research, hunting, and automation.
The researcher will investigate malicious open-source packages and campaigns, study adversaries and emerging attack methods, and help strengthen detection across programming-language ecosystems. The role also works with engineering to turn research findings into scalable, real-time product protections.
The listed annual compensation is $126,000–$170,000. Socket describes benefits including equity, health coverage for employees and their families with 99% coverage, flexible time off, holidays and a winter shutdown, paid parental leave, and quarterly team off-sites in a remote-first environment.
Role at a glance: Socket seeks a U.S.-based remote Threat Researcher to investigate software supply-chain threats and build research-driven protections; compensation is $126,000–$170,000 per year.
Responsibilities mentioned in the listing
- Analyze a high volume of distinct threats each day while maintaining rigorous research quality.
- Write technical posts and in-depth reports on malicious open-source packages and extensions, campaigns, threat actors, new attack vectors, and ecosystem trends.
- Create automation and analysis tools to improve malware research, data gathering, threat analysis, and hunting workflows.
- Work with engineering to incorporate research into Socket’s product and deliver scalable, real-time protection.
- Apply open-source ecosystem knowledge to secure package registries and Chrome and VS Code extensions, and monitor GitHub and GitLab for emerging malicious campaigns.
- Track advanced persistent threat (APT) adversaries, including their tactics, techniques, procedures, capabilities, infrastructure, and campaigns.
Qualifications stated in the listing
- At least 3 years of work experience and a master’s degree in computer science, engineering, or a related discipline, or equivalent experience.
- Technical experience in multiple security operations areas, such as investigations, incident response and management, digital forensics, malware analysis, reverse engineering, threat intelligence, threat hunting, and detection engineering.
- Strong communication skills and the ability to judge the relevance and potential impact of threats.
- Experience developing tools for automation, data collection, and threat hunting.
- Interest in open-source software and code.
- Preferred: familiarity with TypeScript, JavaScript, or other programming languages and ecosystems protected by Socket.
- Preferred: experience using LLMs or AI-based tools for threat detection.
Full details from the source listing
About Us
Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our customers - from Anthropic to xAI, and Figma to Vercel - love Socket (just check out their tweets to see for yourself!)
Founded by Feross Aboukhadijeh, a long-time open source maintainer with software downloaded over a billion times a month, Socket has raised $125M in funding from top angels, operators, and security leaders.
About the Role
Socket is looking for a Threat Researcher to join our growing Threat Intelligence Team. In this role, you’ll tackle cutting-edge threats in the software supply chain, leveraging our proprietary AI-based scanner and building tools to enhance malware analysis. You’ll secure open source ecosystems, strengthen threat detection across multiple programming languages, and conduct research that helps protect developers and organizations worldwide. This is not an entry-level position. This is a hands-on role for someone passionate about threat hunting, security research, automation, and turning insights into actionable defenses.
What You'll Do
Analyze numerous unique threats daily, maintaining a standard of quality that sets the industry benchmark for supply chain security.
Author high-impact technical blog posts on malicious open source code packages and extensions, and publish deep-dive research pieces on malicious campaigns, threat actor profiles, novel attack vectors, and ecosystem-wide trends.
Design and build automated scripts and tools to streamline malware analysis, enhancing our data collection, threat analysis, and threat hunting workflows.
Partner with our engineering team to integrate your research into our core product, turning manual insights into scalable, real-time protection.
Leverage expertise in open source software ecosystems to enhance security across package registries, browser extensions (Chrome/VS Code), and proactively monitor GitHub/GitLab for emerging malicious campaigns.
Track APT (Advanced Persistent Threat) adversaries, characterizing various TTPs (Tactics, Techniques, and Procedures), capabilities, infrastructure, and campaigns.
What You'll Bring
Required:
3+ years of work experience and a master’s degree in computer science, engineering, or a related field (or equivalent experience).
Technical experience across several areas of security operations, including investigations, incident response and management, digital forensics, malware analysis, reverse engineering, threat intelligence, threat hunting, and detection engineering.
Excellent communication skills and the ability to assess the relevance and impact of threats.
Experience building tools for automation, data collection, and threat hunting.
Passion for open source and code.
Preferred:
Familiarity with TypeScript/JavaScript and/or other programming languages and ecosystems protected by Socket.
Experience leveraging LLMs or AI-based tools for threat detection.
Hiring is a big decision on both sides. Read more about our Hiring Philosophy and how we approach the process at Socket.
Benefits: Our benefits are crafted to support you and your family, so you can take care of what matters most and thrive in and outside of work. We offer:
Market competitive salary bands
Meaningful equity program
Comprehensive health benefits for you and your family (99% coverage)
Flexible time-off, holidays, and winter shutdown to rest & recharge
Paid parental leave
Remote-first, with quarterly team off-sites
At Socket, we
Pursue Excellence: We set ourselves apart by consistently delivering work of exceptional quality and distinction.
Move with urgency and focus: We prioritize swift, decisive action.
Think rigorously: We care about being right and it often takes reasoning from first principles to get there. We value alternative perspectives and have constructive discussions.
Trust and amplify: We overtrust, always assume good intent, and give specific feedback to help each other improve.
Feel a strong sense of ownership: We wear many hats and feel a strong sense of overall ownership of the company and we're non-territorial regarding our nominal domains.
Are customer obsessed: We relentlessly prioritize the needs of our customers, striving to exceed their expectations and delight them at every interaction.