Postdoc in Software Systems & Software Supply-Chain Security

Applications are invited for a postdoctoral position with the MadriSec group at the IMDEA Software Institute in Madrid. Working with Prof. Georgios Portokalidis, the successful candidate will develop practical techniques and tools to detect malicious software updates and identify undeclared, unpatched code in software repositories. The project is supported by the María de Maeztu programme.

Research

The project focuses initially on the Python ecosystem and combines program analysis with LLM-assisted code review. Topics include:

• Identifying suspicious commits and analysing the behavioural changes introduced by updates.
• Grounding LLM-based review in program-analysis evidence and evaluating robustness against evasion and prompt injection.
• Detecting known-vulnerable code copied or vendored into repositories.

The role combines research with building, evaluating and releasing reusable analysis tools, in collaboration with researchers in cybersecurity and software engineering. The postdoc will also contribute to mentoring students and interns.

Who should apply

Applicants should have:

• A PhD in Computer Science or a closely related field, completed within the last three years.
• Strong programming and software engineering skills, demonstrated through prior projects (e.g., open-source repositories, research prototypes, compilers, analysis tools).
• Research experience in software security, program analysis or a related area.
• Experience with Python, static analysis, software supply chain security or LLM-based tools is particularly relevant.
• Excellent written and spoken English.

Please include links to research prototypes, open-source contributions or other substantial software projects in your application.

Why IMDEA Software

IMDEA offers an international research environment in Madrid, a competitive salary and social benefits, and travel support for research. English is the working language; Spanish is not required.

Dates

Desired start date: 11 January 2027.
Application deadline: 6 November 2026.

How to apply?

Applicants interested in the position should submit their application at https://careers.software.imdea.org/ using reference code 2026-10-postdoc-supplychain.

The recruitment process will comply with the IMDEA Software Institute’s OTM-R Policy (Open, Transparent and Merit-based Recruitment).

Questions?

Contact Georgios Portokalidis at .

Part of Grant CEX2024-001471-M funded by MICIU/AEI/10.13039/501100011033