Vulnerability Researcher

About the role

This role involves designing and building agentic systems that autonomously hack into real targets across firmware, network stacks, mobile operating systems, and IoT. The primary function is vulnerability research.

Responsibilities

• Own vulnerability discovery end-to-end against real firmware, network stacks, mobile OSes, and IoT targets using emulation stacks, instrumentation, and fuzzing pipelines.
• Wire emulation environments (QEMU, Unicorn, Qiling) and instrumentation tooling (Frida, DynamoRIO) into agent-accessible tool interfaces.
• Design and build evaluation and benchmarking infrastructure that measures whether the agentic vulnerability research pipeline is working.
• Develop and weaponize exploits from discovered vulnerabilities, turning raw findings into working exploit primitives.
• Contribute to agent harness orchestration, tool-use design, and eval loops that power autonomous vulnerability research at scale.

Requirements

• Vulnerability research as primary current role function
• Strong RE and debugger chops (GDB, IDA, or Ghidra)
• 2 to 3 or more years C, C++, or Rust systems programming
• Deep Linux systems fluency
• NYC in-person 5 days, relocation required
• US citizen or clearance-eligible preferred
• Green Flags: Exploit weaponization experience, Offensive security firm background (NSO, Paragon, or equivalent), Competitive CTF background or public CVEs, AI enthusiast with genuine technical interest in agents
• Red Flags: Vulnerability research is a minority function in current role, Corporate or enterprise-only background without startup fit, Not willing or able to work in-person in New York five days per week, Foreign national from a country the company does not sell to

Benefits

The role offers a competitive compensation package including $220,000–$350,000 base salary plus equity.

Pay

$220,000–$350,000 + competitive equity

Schedule

In-person 5 days per week; no remote option; relocation required