Missions

Modern software systems are built from intricate assemblies of components and libraries, with complex dependency graphs and opaque supply chains. This complexity creates opportunities for vulnerabilities and backdoor insertion, whether accidental or malicious.
The SECUBIC project aims to improve software supply-chain security by:
• Identifying and characterizing software components in binary artifacts,
• Detecting backdoors and other malicious manipulations,
• Understanding, modeling, and anticipating supply-chain attack scenarios,
• Exploring active defense strategies based on offensive reasoning.

Activités

The postdoctoral researcher will focus on binary-level analysis for software compliance and security, with a strong emphasis on:
• Static and dynamic analysis of binaries and software components,
• Backdoor and malicious modification detection,
• Reasoning about and prototyping offensive techniques to strengthen defense (red-teaming style),
• Contributing to tools and methodologies to secure software supply chains.

Compétences

We are looking for a motivated and autonomous researcher with a strong background in software security and/or program analysis and/or ML.
Required qualifications:
• PhD in Computer Science
• Ability to work both independently and collaboratively in a research team.

Contexte de travail

The postdoc will be supervised by Jean-Yves Marion and will be part of the Carbone team at LORIA, working in close collaboration with the other members of the SECUBIC project and their groups: Sébastien Bardin, Michaël Marcozzi and Stefano Zacchiroli.
The position offers rich opportunities for collaboration within the French and European cybersecurity community, including interactions with teams working on program analysis, formal methods, systems security, and open-source software.

Le poste se situe dans un secteur relevant de la protection du potentiel scientifique et technique (PPST), et nécessite donc, conformément à la réglementation, que votre arrivée soit autorisée par l'autorité compétente du MESR.

Contraintes et risques

none