We're looking for a Head of Research to lead Guardio Labs - the research group at the core of how Guardio works. What Labs uncovers becomes the detections that ship to production, the signals that train our models, and the product bets we make next.
You may already know our work : HermeticReader, AccountDumping, GoogleFix, SubdoMailing, EchoSpoofing, CVE-2024-21388 in Microsoft Edge, 0-days in Opera, and the first serious research on how agentic AI browsers get scammed - covered by Forbes, Dark Reading, PCMag, and more. That's the bar. You'll own raising it.
This is a true player-coach role, reporting directly to our executive management. You'll build and lead the team while keeping your hands firmly on the keyboard - because the person setting the research agenda should be the kind who stays up unpacking a phishing kit they just had to understand.
You will:
Build the team: hire researchers, define what "great" looks like, and grow analysts into hunters who follow a lead wherever it goes - with headcount and runway to do it right.
Set the research agenda: decide where we hunt and what deserves our firepower - phishing kits, scam infrastructure, malvertising, malicious extensions, messaging abuse, and techniques that don't have a name yet.
Hunt alongside your team: investigate leads end-to-end across web, email, SMS, calls, and social platforms; reverse-engineer payloads, kits, and attacker infrastructure until the whole operation is mapped.
Drive innovation across the product: work with analysts, engineers, and product leadership to turn discoveries into shipped protections - in days, not quarters - with a real voice in what Guardio builds next.
Own the threat knowledgebase: build the systems and automation that turn raw telemetry from 1M+ users into structured intelligence and the anomaly that becomes next month's headline.
Put Guardio Labs on the map: drive publications the industry actually reads, own responsible disclosure with major vendors, and represent Guardio at conferences and in the press.
Sounds great! Am I the right fit?
You might be the person we're looking for if you check many of the following:
Elite intelligence unit background - where you learned to chase signals through noise, connect dots no one else sees, and never let a lead go cold.
5+ years of hands-on experience in security research, threat intelligence, or offensive/defensive cyber - with battle scars to show for it.
Proven leadership: you've led and grown researchers or analysts, and you know how to build a team while still shipping results yourself.
Technical depth where it counts. Fluent enough to direct and review the work in : Browser internals and extensions, DOM/JavaScript (including deobfuscation), network and infrastructure analysis (DNS, WHOIS, TLS, HTTP/S flows, hosting patterns), email authentication and abuse (SMTP, SPF/DKIM/DMARC), or telephony/SMS abuse.
AI-first by instinct. You already use LLMs and agents as research infrastructure - not as a novelty - and you know where they break.
Fluent in data: querying large-scale datasets with SQL, BigQuery, or pandas - finding trends and anomalies in very noisy data.
A builder's mindset: you write Python/JavaScript when off-the-shelf doesn't cut it, and you automate the boring parts by reflex.
A hunter's DNA: analytical, persistent, endlessly curious - with the judgment to know which rabbit holes are worth it, and the discipline to bring your team back out.
Strong communicator: you can brief leadership, align product and engineering, and publish research that shapes the conversation.
Talk nerdy to me.
Don't mind if we do. Some notable facts:
Over 1 million users mean we get A LOT of threat leads and unique insights - real victims, not a sandbox.
We build omni-channel detectors that fuse signals across web, email, SMS, and voice - the weak signal on one surface becomes conclusive across all four.
AI is how we work, not just a topic we write about: LLM-driven triage, automated deobfuscation, and agentic hunting pipelines that chase a lead before a human ever looks at it.
We use lots of Python, BigQuery, and vibe-code our brains out!
We build our own research tools and platforms - but we also love Chrome DevTools, Burp, VirusTotal, URLScan and every OSINT trick in the book.
Thinking of a great addition? Let's do it!
See what the team has been publishing: labs.guard.io
Requirements
