Vulnerability Researcher

This is a fully remote position, open to applicants in Poland, +1 more country.

📋 Description

• Evaluate cybersecurity prompts submitted to an AI system that are uncertain in classifying them as either benign or malicious.

• Identify the core intent and objective behind each prompt, assessing whether the intention is legitimate or harmful.

• Utilize domain expertise to analyze the technical context, specificity, and the potential real-world impact a response could have for an attacker.

• Label each prompt with an intent classification and provide a clear written explanation in accordance with project guidelines.

• Independently annotate the same prompts as a secondary researcher.

• Elevate cases where there is a disagreement among researchers to a reviewer.

• Highlight ambiguous cases, new attack techniques, and any inconsistencies in the guidelines.

• Contribute to the enhancement of the project guidelines.

⛳️ Requirements

• At least 5 years of demonstrable, hands-on experience in vulnerability research and reverse engineering.

• Proven capability to identify vulnerabilities through fuzzing, static and dynamic analysis, and patch diffing.

• Experience in exploit development, including memory corruption, heap exploitation, ROP, and bypass techniques (ASLR, DEP, CFI).

• Proficient in using IDA, Ghidra, Binary Ninja, and debuggers (WinDbg, GDB, LLDB) on x86/x64 and ARM binaries.

• Familiarity with the CVE lifecycle, understanding of n-day versus 0-day work, and knowledge of how public PoCs are weaponized.

• Strong analytical skills to deduce a user's underlying intent from a brief prompt and to differentiate between defensive, educational, and research purposes versus attack preparation.

• Ability to communicate clearly in written English, with a knack for documenting reasoning succinctly.

• OSED, OSEE, or GIAC GXPN certifications are advantageous.

• Demonstrated online accomplishments, write-ups, or contributions on platforms such as HackTheBox, Pwn2Own, TryHackMe, Bug Bounty programs, or published security research are desirable.

🏝️ Benefits

• Benefits provided by SD Solutions; further details can be obtained by reaching out to the company.

• Opportunity to join a freelance contributor pool as mentioned in the company description.