CNO - Vulnerability Researcher - RE, Embedded, 0-Day
$150,000–$260,000 year
On-siteAnnapolis Junction, Maryland, United States
Job Summary
Debug software, troubleshoot crashes, and perform source code analysis to discover software flaws and author documentation on their impact and severity. Develop proof-of-concept exploits against research targets and lead reverse engineering of hardware, software, and operating systems to determine functionality and code structure for initial access capabilities. Provide technical presentations on assigned projects and utilize tools like IDA Pro, Ghidra, and fuzzers to identify code flow and abstract concepts. Requires Top-Secret/SCI clearance; no sponsorship available. Salary ranges from $150,000 to $260,000.
Required Qualifications
- A current Top-Secret/SCI with polygraph security clearance
- Candidates cannot be sponsored or nominated for a government security clearance
- Bachelor's Degree in Computer Science or related field
- Minimum two (2) years' experience in computer science, information systems, or network engineering
- Minimum two (2) years' experience programming in Assembly, C, C#, C++, Perl, or Python
- Minimum two (2) years demonstrated experience in either hardware or software reverse engineering
- 0-day vulnerabilities or CVEs discovered and attributed to themselves
- History performing vulnerability research
- Experience with writing or using fuzzers – AFL, LibFuzzer, ClusterFuzz, oss-fuzz
- Experience with code analysis tools – CodeQL, Joern, Semgrep
- History of exploiting or productizing 0-day vulnerabilities
- History of exploiting or productizing n-day vulnerabilities/CVEs/publicly disclosed vulnerabilities
- History of reverse engineering malware or other code for CNE purposes
- Experience with reverse engineering tools – Ghidra, Ida Pro, Binary Ninja
- Experience using debuggers – GDB or WinDbg
- Experience writing, navigating, and building C/C++ code
- Familiarity with ARM or MIPS architectures and Linux variants
Desired Qualifications
- The use of Unix/Windows system API's
- Understanding of virtual function tables in C++
- Heap allocation strategies and protections
- Experience with very large software projects
- Kernel programming experience (WDK / Unix||Linux)
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.