Browser Vulnerability Researcher

This is a fully remote position, open to applicants in Greece.

📋 Description

• Conduct research on security vulnerabilities in contemporary browsers such as Firefox, Chromium-based, and WebKit-based browsers.

• Execute source-code audits of substantial C/C++ codebases to pinpoint memory-safety, logic, sandbox, and privilege-boundary vulnerabilities.

• Explore the internals of JavaScript engines like V8, SpiderMonkey, and JavaScriptCore.

• Assess browser sandbox boundaries and investigate potential sandbox-escape vulnerabilities.

• Reverse engineer browser binaries and security-critical operating system components.

• Debug crashes and memory-corruption issues utilizing WinDbg, GDB, LLDB, AddressSanitizer, and related tools.

• Create fuzzers, harnesses, and automation for the discovery of vulnerabilities.

• Examine exploit mitigations such as ASLR, DEP/NX, Control Flow Guard, CET, CFI, MTE/MIE, pointer authentication, and sandboxing techniques.

• Develop proof-of-concept exploits to validate vulnerabilities and comprehend their practical implications.

• Generate clear technical reports outlining the root cause of vulnerabilities, their exploitability, and the components affected.

⛳️ Requirements

• Extensive knowledge of C/C++ and x64/aarch64 assembly language.

• Strong understanding of memory management, pointers, object lifespan, and concurrency.

• In-depth knowledge of operating system internals, especially Android and iOS.

• Proficiency with reverse-engineering tools such as IDA Pro, Ghidra, Binary Ninja, or similar applications.

• Familiarity with browser architecture and multiprocess sandboxing designs.

• Experience in analyzing large codebases.

• Knowledge of prevalent memory-corruption vulnerability classes and exploitation methods.

• Familiarity with debugging and sanitization tools like ASan, UBSan, WinDbg, GDB, or LLDB.

• Capability to independently investigate intricate technical issues and clearly document findings.

• Preferred: experience in researching Chrome, Firefox, or Safari.

• Preferred: experience in developing browser exploits or engaging in vulnerability disclosure or bug-bounty initiatives.

• Preferred: experience with coverage-guided fuzzing tools such as libFuzzer, AFL++, or custom fuzzing frameworks.

• Preferred: familiarity with modern exploit-development techniques, including heap manipulation, arbitrary read/write primitives, information leaks, and control-flow manipulation.

• Preferred: understanding of compiler-generated mitigations and browser hardening measures.

🏝️ Benefits

• An opportunity to be part of a rapidly growing, global cybersecurity organization.

• A collaborative, mission-driven team with a strong focus on learning.

• Competitive salary and benefits package.

• Paid day off for your birthday.

• Complimentary coffee, lunch, and office snacks.

• Private medical and life insurance for employees and their family members.

• Funding for certifications and postgraduate programs.

• Recognition programs, including welcome gifts, New Year celebration gifts, referral bonuses, and long-service vouchers.

• Exposure to international teams, leaders, and challenges.

• Opportunities for professional growth, development, and innovation.