---
title: 'Associate Security Researcher at Cobalt'
canonical: 'https://feeny.ai/job/associate-security-researcher-cobalt-united-states-east-or-central-harmhwjdkykt'
type: 'job'
last_seen: '2026-11-04'
---

# Associate Security Researcher at Cobalt

- **Company:** Cobalt
- **Location:** United States (East or Central)
- **Work type:** remote
- **Posted:** 2026-10-30
- **Last confirmed live:** 2026-11-04
- **Apply:** https://job-boards.greenhouse.io/cobaltio/jobs/8924332002

## Job description

Description

At Cobalt, our Offensive Security Research team bridges the gap between emerging adversary tradecraft, automated security validation, and real-world penetration testing. We do not need a narrow, single-domain specialist for this seat. We are looking for a high-agency, multi-skilled Associate Security Researcher who loves building, scripting, testing, and solving practical technical problems across the stack.

Think of this role as a technical utility player for Offensive Security Research. One day you will build containerized lab environments in Docker and GCP or wire up Python scripts to benchmark emerging offensive security tools and AI models. The next day you will collaborate with Senior Researchers to validate vulnerability findings, refine testing methodologies (Web, API, Cloud, IoT, and AI/LLM), and review specialized penetration testing reports for technical accuracy. You will bring broad foundational skills across systems, code, and security, and we will mentor you into a full-scale Security Researcher.

## What You’ll Do

- Research Infrastructure & Lab Engineering: Build, deploy, and maintain containerized testing harnesses, vulnerable lab targets, and cloud sandboxes (Docker, Linux, GCP/AWS) to support tool bake-offs and vulnerability research.
- Tooling & Workflow Automation: Write and maintain practical scripts in Python, Bash, or Go to automate research data collection, scanner template validation (such as Nuclei), and offensive testing workflows.
- Emerging Tech & AI Security Testing: Assist Senior Researchers in evaluating autonomous security tools, testing LLM and Model Context Protocol (MCP) integrations, and building practical proof-of-concept (PoC) labs.
- Methodology & Tradecraft Support: Help maintain and expand Cobalt's offensive testing methodologies, checklists, and quarterly methodology reviews across Web, API, Network, Cloud, IoT, and AI attack surfaces.
- Technical Quality Control & Authorship: Partner with our Technical Project Management (TPM) and Delivery teams to review specialized penetration testing findings and final reports (Red Team, Secure Code Review, IoT, Digital Risk, and AI). Ensure technical accuracy and actionable remediation guidance.
- Documentation & Knowledge Sharing: Maintain high-quality documentation of research findings, scripts, and internal wikis, with opportunities to present research and co-author technical blogs.

You Must Have

We are not looking for a point-and-click scanner operator, and you do not need to be a 10-year exploit developer. We want a curious, methodical builder and generalist. You understand how modern systems, networks, and applications fit together, and you know how to glue things together with code.

- Broad Technical Foundation (The Utility Player): 1 to 3+ years of hands-on experience across Systems/Cloud Administration, DevSecOps, Application Development, Security Operations, or Junior Penetration Testing. You understand servers, Linux/Windows internals, networking, APIs, permissions, and logs because you have built and managed them.
- Practical Scripting & Automation: Working proficiency with Python, Bash, or PowerShell, plus familiarity with Git/GitHub and technical documentation.
- Containers & Lab Environments: Hands-on familiarity with Docker, virtual machines, and home-lab or cloud environments for spinning up test infrastructure.
- Security & Pentesting Fundamentals: Solid grasp of penetration testing methodology (reconnaissance, scanning, exploitation, and remediation) and common vulnerability classes (OWASP Top 10, API flaws, cloud misconfigurations).
- Clear Technical Writing: Ability to review technical findings and translate complex issues into accurate, actionable remediation guidance.
- US-Based & Time Zone Alignment: For logistical and compliance reasons, this role is strictly limited to candidates residing in the Continental United States. Preference is given to EST or CST to align with our morning-heavy meeting schedule, though all US time zones are welcome.

## Nice to Have

- Hands-on interest or experience with AI/LLM security (prompt injection, agentic workflows, MCP servers, or model testing).
- Experience writing or tuning custom detection or scanning templates (such as Nuclei or Semgrep).
- Cloud security familiarity across GCP, AWS, or Azure and DevSecOps pipelines.
- Security certifications such as Security+, CySA+, GSEC, eJPT, PNPT, CPTS, CWES, OSAI, or working toward an OSCP.
- Comfort presenting technical topics or research to small groups or community office hours.

## Why You Should Join Us

- Grow in a passionate, rapidly expanding industry operating at the forefront of the Pentesting industry
- Work directly with experienced senior leaders with ongoing mentorship opportunities
- Earn competitive compensation and an attractive equity plan
- Save for the future with a 401(k) program (US) or pension (EU)
- Benefit from medical, dental, vision and life insurance (US) or statutory healthcare (EU)
- Leverage stipends for:
- Wellness
- Work-from-home equipment & wifi
- Learning & development
- Make the most of our flexible, generous paid time off, and paid parental leave

Pay Range Disclosure

Cobalt is committed to fair and equitable compensation practices. The salary range for this role is ($60k - 80k ) per year + equity + benefits. A candidate’s salary is determined by various factors including, but not limited to, relevant work experience, skills, and certifications.  The salary range may differ in other states and may be impacted by proximity to major metropolitan cities.

Cobalt (the "Company") is an equal opportunity employer, and we want the best available persons for every job. The Company makes employment decisions only based on merit. It is the Company's policy to prohibit discrimination in any employment opportunity (including but not limited to recruitment, employment, promotion, salary increases, benefits, termination and all other terms and conditions of employment) based on race, color, sex, sexual orientation, gender, gender identity, gender expression, genetic information, pregnancy, religious creed, national origin, ancestry, age, physical/mental disability, medical condition, marital/domestic partner status, military and veteran status, height, weight or any other such characteristic protected by federal, state or local law. The Company is committed to complying with all applicable laws and providing equal employment opportunities. This commitment applies to all persons involved in the operations of the Company regardless of where the employee is located and prohibits unlawful discrimination by any employee of the Company.

Cobalt is an E-Verify employer. E-Verify is an Internet-based system operated by the Department of Homeland Security (DHS) in partnership with the Social Security Administration (SSA). It allows participating employers to electronically verify the employment eligibility of their newly hired employees in the United States.

## About Cobalt

## Company Overview
- **One-liner**: Cobalt provides a human-led, AI-powered Pentest as a Service (PtaaS) platform that enables organizations to conduct continuous offensive security testing across their attack surface.
- **Entity Type**: Private (venture-backed startup)
- **Headquarters**: United States (remote-first, with Scandinavian roots and presence in US, UK, and Germany)
- **Founded**: 2013
- **Founders**: Martin Rannje and Christian Hansen (co-founders, per leadership page) [cobalt.io/team]

## Core Business
- **Primary industry**: Cybersecurity – specifically Penetration Testing as a Service (PtaaS) and offensive security.
- **Target customers**: B2B, ranging from SMB to enterprise, with a focus on development, security, and operations teams.
- **Mission**: To help organizations “operate fearlessly and innovate securely” by making security testing faster, simpler, and more transparent. [cobalt.io/about]

## Products & Services
- **Cobalt Platform (PTaaS)**: SaaS platform that pairs with a vetted community of pentesters to deliver on-demand penetration tests, starting in as little as 24 hours. Includes automated reconnaissance, AI-powered exploit intelligence, and integrations with ITSM, DevOps, and collaboration tools.
- **Offensive Security Services**: Penetration testing (web, mobile, network, cloud), Digital Risk Assessment (identifying publicly exposed information), and Secure Code Review.
- **Cobalt Core**: An exclusive community of over 400 highly vetted pentesters (acceptance rate ~5%) who conduct thousands of tests annually. Creates a talent marketplace for on-demand security expertise.

All offerings emphasize human expertise amplified by AI and a decade of proprietary exploit intelligence. [cobalt.io]

## Market Standing
- **Valuation**: Not publicly available.
- **Key Metric**: Over 1,500 customers served; platform delivers 2.6x faster time to report and gets customers to remediation 50% faster than traditional approaches.
- **Notable Investors/Partners**: Not disclosed in provided sources.
- **Growth Signals**: Fast-growing remote-first cybersecurity start-up; expanding globally with employees from 45+ nationalities; recognized as an award-winning “best workplace”; continuous product innovation in AI and automation. [cobalt.io/life][cobalt.io/about]

## Competitive Advantages
- **Human-Led, AI-Powered Pentesting**: Combines creative human testing (focusing on business logic abuse) with proprietary exploit intelligence AI to automate recon and isolate high-risk vulnerabilities faster.
- **Speed & Scale**: Start a pentest in 24 hours; 2.6x faster report turnaround; 50% faster remediation cycle.
- **Exclusive Talent Pool**: The Cobalt Core accepts only 5% of applicants, ensuring access to top-tier, vetted security experts.
- **Unified Platform**: Single pane of glass for managing findings, integrations with dev workflows, and continuous testing across the attack surface.

## Strategic Focus
- **Continuous Offensive Security**: Moving away from point-in-time testing to ongoing, proactive risk management.
- **AI Integration**: Leveraging over a decade of exploit data to continuously refine testing logic and improve automation.
- **Scaling the Community**: Expanding the Cobalt Core and platform to address global shortage of skilled security resources.
- **Customer Agility**: Empowering organizations to do more with less by integrating security testing into development cycles.

## Why Work Here
- **Culture & Values**: Emphasizes “Innovate Relentlessly,” “Lead with Grit,” “Quality at Speed and Scale,” and “One Cobalt.” Fully remote, remote-first with flexible PTO.
- **Perks**: Competitive compensation + equity, medical/dental/life insurance (US), 401k matching, paid parental leave, monthly stipends for wellness, WFH office setup, WiFi, and learning & development.
- **Diversity**: 45+ nationalities; equal opportunity employer that values inclusion and diverse perspectives.
- **Team**: Work directly with experienced senior leaders in a rapidly growing PtaaS market; opportunity to “make your mark.” [cobalt.io/life][job-boards.greenhouse.io/cobaltio]

## Sources
1. [Cobalt Homepage](https://www.cobalt.io)
2. [Careers at Cobalt (Greenhouse)](https://job-boards.greenhouse.io/cobaltio)
3. [About Cobalt](https://www.cobalt.io/about)
4. [Life at Cobalt](https://www.cobalt.io/life)
5. [Leadership Team](https://www.cobalt.io/team)

## Other roles at Cobalt

- [Staff AI Engineer](https://feeny.ai/job/staff-ai-engineer-cobalt-remote-v4kva1gbhr3m)
- [Director of Product Management, Platform](https://feeny.ai/job/director-of-product-management-platform-cobalt-united-states-east-or-central-6d740n38tb51) — United States (East or Central)
- [Senior Technical Product Manager](https://feeny.ai/job/senior-technical-product-manager-cobalt-united-states-east-or-central-yzg09at37y4w) — United States (East or Central)
- [Enterprise Account Director](https://feeny.ai/job/enterprise-account-director-cobalt-united-states-north-central-85xxf0hrfqwz) — United States (North Central)
- [Senior Growth Marketing Manager](https://feeny.ai/job/senior-growth-marketing-manager-cobalt-united-states-east-or-central-gad8b0ycye6a) — United States (East or Central)
- [Senior GTM Systems & AI Specialist](https://feeny.ai/job/senior-gtm-systems-ai-specialist-cobalt-united-states-vye5sgzc3h31) — United States