Security Research Engineer

Cowbell is signalling a new era in cyber insurance by harnessing technology and data to provide small and medium-sized enterprises (SMEs) with advanced warning of cyber risk exposures bundled with cyber insurance coverage adaptable to the threats of today and tomorrow. Championing adaptive insurance, Cowbell follows policyholders’ cyber risk exposures as they evolve through continuous risk assessment and continuous underwriting. In its unique AI-based approach to risk selection and pricing, Cowbell’s underwriting platform, powered by Cowbell Factors, compresses the insurance process from submission to issue to less than 5 minutes. Founded in 2019 and based in the San Francisco Bay Area, Cowbell has rapidly grown, now operating across the U.S., Canada, U.K., and India. This growth was recently bolstered by a successful Series C fundraising round of $60 million from Zurich Insurance. This investment not only underscores the confidence in Cowbell’s mission but also accelerates our capacity to revolutionize cyber insurance on a global scale. With the backing of over 25 prominent reinsurance partners, Cowbell is poised to redefine how SMEs navigate the evolving landscape of cyber threats. Cowbell Cyber is hiring a Cyber Security Researcher to join our Data Science team. Key Responsibilities Security Research & Testing: Conduct in-depth security assessments and manual penetration testing of web apps, APIs, and cloud services. Perform source code reviews and analyze proprietary applications for flaws (e.g., injection, authorization issues, business logic abuse, misconfigurations). Develop custom tooling and Proof-of-Concept (POC) exploits to validate findings. Vulnerability Discovery: Research emerging attack techniques, exploit chains, and zero-day vulnerabilities in internal applications and supporting systems. Conduct threat modeling and evaluate software supply chain and dependency risks. Engineering Collaboration: Partner with engineering teams throughout the SDLC to provide secure coding guidance, support architecture reviews, and integrate security testing into CI/CD pipelines. Contribute to internal security standards. Reporting: Document vulnerabilities, exploitability, and remediation guidance in clear reports. Present findings to stakeholders, track remediation efforts, and verify fixes. Required Qualifications 5+ years of experience in application security, vulnerability research, or offensive security. Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent practical experience. Strong knowledge of secure development practices, manual security assessments, and source code reviews. Deep understanding of: OWASP Top 10, API Security Top 10, modern web application architectures, secure authentication and authorization models, and cloud security fundamentals. Proficiency with one or more programming languages (Python, Java, JavaScript/TypeScript). Strong understanding of Linux, networking, and web protocols; experience using common security testing tools. Preferred Qualifications Experience discovering novel vulnerabilities, participating in bug bounty/disclosure programs, or background in exploit development/reverse engineering. Knowledge of modern cloud environments (AWS, Azure, GCP), container security/Kubernetes, and building custom security tooling. Experience with current vulnerability research tools ( i.e. Burp Suite, Nuclei, Ghidra). Public vulnerability research, conference presentations, blog posts, or published CVEs. Preferred Certifications One or more of the following: OSCP OSWE OSEP GXPN Relevant GIAC certifications Success Metrics (Within the first 12 months) Identify and validate critical and high-risk vulnerabilities before production impact. Improve application security posture through proactive research and testing. Reduce vulnerability remediation timelines through effective collaboration. Develop repeatable testing methodologies and security automation. Contribute meaningful research into emerging threats. Equal Employment Opportunity: We are committed to equal opportunity in the terms and conditions of employment for all employees and job applicants without regard to race, color, religion, sex, sexual orientation, age, gender identity or gender expression, national origin, disability, or veteran status. Cowbell is a leading innovator in cyber insurance, dedicated to empowering businesses to always deliver their intended outcomes as the cyber threat landscape evolves. Guided by our core values of TRUE—Transparency, Resiliency, Urgency, and Empowerment—we are on a mission to be the gold standard for businesses to understand, manage, and transfer cyber risk. At Cowbell, we foster a collaborative and dynamic work environment where every employee is empowered to contribute and grow. We pride ourselves on our commitment to transparency and resilience, ensuring that we not only meet but exceed industry standards. We are proud to be an equal opportunity employer, promoting a diverse and inclusive workplace where all voices are heard and valued. Our employees enjoy competitive compensation, comprehensive benefits, and continuous opportunities for professional development. Cowbell is an E-Verify employer. E-Verify is a web-based system that allows an employer to determine an employee's eligibility to work in the US using information reported on an employee's Form I-9. The E-Verify system confirms eligibility with both the Social Security Administration (SSA) and Department of Homeland Security (DHS). For more information, please go to the USCIS E-Verify website. For more information, please visit https://cowbell.insure/. Cowbell Cyber does not permit the use of AI tools during any stage of our interview process. By submitting your application, you agree to complete all assessments and interviews without the use of generative AI assistance.