Cleared Vulnerability Research Engineer

Responsibilities

• ▹Design, develop, and validate novel vulnerability discovery and exploitation capabilities
• ▹Conduct expert reverse engineering of binaries (x86-64, ARM64, etc.) using industry-standard tools
• ▹Identify and exploit real-world vulnerabilities such as use-after-free, type confusion, integer truncation, and buffer overflow
• ▹Discover new, previously unknown vulnerabilities in complex systems
• ▹Employ manual analysis and automated techniques (e.g. fuzzing) for vulnerability discovery
• ▹Code and debug complex functions in C, Python, and Assembly
• ▹Independently manage research objectives: scoping, research, experimentation, validation, iteration
• ▹Travel to customer sites as required

Requirements

• ▹Expertise in reverse engineering of binaries (x86-64, ARM64) using tools such as Binary Ninja, Ghidra, or IDA Pro
• ▹Precise understanding of stack and heap objects and exploit-relevant vulnerabilities (use-after-free, type confusion, integer truncation, buffer overflow)
• ▹Demonstrated ability to discover new vulnerabilities, not just exploit known ones
• ▹Experience with both manual analysis and automated techniques (fuzzing)
• ▹Ability to code and debug in C, Python, and Assembly (x86-64, ARM)
• ▹Ability to independently translate under-defined mission objectives into concrete, technically novel capabilities
• ▹TS/SCI clearance required (inactive SCI acceptable if SCI-clearable)
• ▹Ability to travel to customer sites as required

Soft skills

What we offer

• ▹Base pay range: $154,800–$193,500 (US national average)
• ▹Eligible for discretionary bonus or commission plan
• ▹Remote work with occasional travel to a cleared customer site (Alabama)

About the company

Bugcrowd has run a crowdsourced cybersecurity platform since 2012, connecting a global network of ethical hackers with its AI-powered Security Knowledge Platform (CrowdMatch™). Headquartered in San Francisco and New Hampshire, it is backed by General Catalyst, Rally Ventures, and Costanoa Ventures.