OSS-SIRT Engineer, Akrites

About the role

The OSS-SIRT Engineer supports the daily operation of the OSS-SIRT by handling vulnerability intake, validation, enrichment, and maintainer coordination. This is a growth role designed to build deep expertise in open source vulnerability management and ecosystem-scale security operations. Defend Critical Open Source Software Against AI-Enabled Cyber Threats. Akrites is a coordinated effort to remediate and disclose vulnerabilities in critical open source software. As part of this effort, we are deploying a pipeline to process large volumes of vulnerability reports, from intake to assessment and disclosure.

Responsibilities

• Triage incoming vulnerability reports and submissions
• Validate records for completeness, accuracy, and schema compliance
• Assist with maintainer and researcher communications
• Support CVE/ID requests and aliasing workflows
• Help maintain dashboards, metrics, and reporting
• Contribute to documentation, playbooks, and runbooks

Qualifications

• 2-5 years in security engineering, application security, or open source development
• Familiarity with vulnerability lifecycles and basic disclosure practices
• Strong written communication skills
• Interest in open source communities and collaboration

Preferred experience

• Exposure to CVE, OSV, or GitHub Advisories
• Experience contributing to open source projects
• Basic scripting or data analysis skills

Success metrics

• Accurate triage and handling of submissions with minimal rework
• Growing autonomy in managing disclosures
• Demonstrated progression toward senior-level responsibilities

Pay

$140,000 - $155,000 USD