Bot & Evasion Engineer
Corny
Careers
Location: Remote
Full-time or contract
About the role
Corny Capital backs and builds early-stage companies. One of our portfolio companies is building in the anti-bot and web-security space, and we’re looking for an engineer who understands these systems from the other side. Your job is to figure out how commercial bot-detection and browser-fingerprinting systems work, where their assumptions break down, and how they can be bypassed. Then you’ll turn that research into working software. You’ll spend most of your time investigating browser behavior, fingerprinting techniques, detection signals, and the systems built to distinguish automated traffic from real users.
What you'll work on
- Analyze commercial anti-bot and fingerprinting systems such as DataDome, Kasada, Cloudflare, and others.
- Determine which browser, network, behavioral, and environmental signals contribute to detection.
- Build automation capable of operating reliably against sophisticated detection systems.
- Work with browser instrumentation, anti-detect environments, proxies, fingerprinting, and challenge systems.
- Turn successful research into tooling that works repeatedly and at scale.
- Document findings so they can be used to improve defensive detection.
- Use whatever tools make the research faster, including LLMs, agents, and retrieval over previous experiments.
What we're looking for
The most important qualification is that you’ve done this before.
We’re particularly interested in people who have:
- Defeated or meaningfully reverse-engineered a commercial bot-detection or browser-fingerprinting system.
- A deep understanding of browser internals and the signals available to detection vendors.
- Experience building large-scale browser automation or scraping infrastructure.
- Worked extensively with proxies, browser fingerprints, anti-detect environments, or similar infrastructure.
- Built systems that work consistently outside of a controlled proof of concept.
- Strong opinions about the current state of bot detection and why common evasion techniques fail.
Public work is useful but not required. Repositories, technical writeups, demos, research, or tools you’ve built are all helpful.
How we work
We’re remote and work primarily asynchronously. Meetings are kept to what is useful.
You’ll have significant freedom over how you approach the problem and which tools you use. What matters is whether the research is sound and what you build actually works.
Compensation and logistics
- Competitive salary or contract rate.
- Remote, with flexible working hours.
- Full-time or contract depending on fit.
How to apply
Send us a short introduction and one example that demonstrates the kind of work you’ve done. That could be a repository, writeup, demo, research project, or a description of how you investigated a particular detection system.
