CodeQL & AI Security - Senior Application Security Research Engineer

Senior Application Security Research Engineer – CodeQL & AI SecurityClient: MicrosoftLocation: Seattle / Redmond / Bellevue, WA – OnsiteDuration: 6+ Months ContractRole SummaryWe are looking for a Senior Application Security Research Engineer with strong hands-on experience in CodeQL, vulnerability research, static/program analysis, and AI-assisted security.The ideal candidate will research and identify software vulnerabilities, develop CodeQL queries and data-flow models, evaluate different vulnerability-detection techniques, and build or evaluate LLM-based security agents for vulnerability discovery, triage, exploit generation, and automated remediation.Key ResponsibilitiesConduct application security and vulnerability research across large codebases.Author and optimize CodeQL queries for new vulnerability patterns.Perform static analysis, program analysis, data-flow analysis, SAST/DAST, and hybrid code analysis.Identify and validate software vulnerabilities and develop proof-of-concept (PoC) exploits.Build and evaluate AI/LLM-based security agents for vulnerability discovery and code analysis.Automate vulnerability triage, severity classification, and false-positive reduction.Develop automated remediation and security-fix workflows.Design experimentation frameworks to compare different security and AI approaches.Measure precision/recall, false-positive rates, detection accuracy, performance, and cost efficiency.Analyze security results across different codebases and identify unusual or outlier behavior.Work with security researchers and software engineers to turn newly discovered vulnerability patterns into scalable detection solutions.Required SkillsApplication Security / Vulnerability ResearchCodeQL query developmentCodeQL data modeling / data-flow modelingStatic Analysis / Program AnalysisSAST / DAST / Hybrid AnalysisVulnerability discovery and analysisSecure software developmentProof-of-concept exploit developmentStrong programming experience with Python, C#, C++, Java, or similarLLMs / Generative AI applied to securityVulnerability triage and false-positive reductionSecurity-tool evaluation and benchmarkingStrong software engineering and analytical skillsPreferred SkillsLLM-based security agentsAI-assisted vulnerability discoveryAutomated exploit generationAutomated vulnerability remediationAI-based code reasoningSecurity severity classificationPrecision/recall evaluation of vulnerability-detection systemsExperience building large-scale security experimentation frameworksExperience with developer security, SAST, code-analysis, or vulnerability-research products