Senior Vulnerability Researcher – Exploit Development

$156,000 - $234,000

St. Petersburg, FL (Melbourne, FL and San Antonio, TX also considered) | On-Site | Relocation Assistance Available

The Opportunity

This is a research role, not a security operations job. You'll spend your time hunting for previously unknown vulnerabilities across operating systems, kernels, firmware, hypervisors, and embedded platforms — reverse engineering compiled binaries, developing proof-of-concept exploits, and defeating modern mitigations like ASLR, DEP/NX, and CFI.

You'll scope your own attack surfaces, drive research from hypothesis to validated finding with minimal direction, and work alongside senior researchers who care about technical depth over titles. If you've spent your career building offensive capability rather than defending against it, this team was built for people like you.

Why You'll Love This Role

You'll work across a genuinely wide target set: x86, x64, ARM, and PowerPC architectures, spanning kernels, firmware, hypervisors, mobile platforms, RTOS, and networking protocols. That breadth means you won't get boxed into a single stack.

The team culture is explicit about valuing technical curiosity over hierarchy — you're encouraged to go deep on the problems that interest you. You'll have access to industry-standard tooling (IDA Pro, Ghidra, fuzzing frameworks, symbolic execution tools) and you'll also help build and improve internal research tooling and automation.

Compensation runs $156K to $234K, and relocation assistance is available if you're not already local to St. Petersburg, Melbourne, or San Antonio.

Your Day-to-Day

• Lead vulnerability research across OS, kernel, firmware, hypervisor, embedded, and application targets
• Identify and evaluate new attack surfaces, carrying research from initial hypothesis to validated finding
• Reverse engineer and perform in-memory analysis of compiled binaries across x86, x64, ARM, and PowerPC
• Develop and validate novel exploitation techniques against modern mitigations
• Analyze undocumented system behavior and build out internal research tooling
• Communicate findings clearly to both technical and non-technical stakeholders
• Mentor other researchers and contribute to team methodology and tooling

What We're Looking For

Experience

• 6+ years of hands-on vulnerability research or exploit development — building, not operating or defending
• A track record of independently leading research through to validated results
• Background in offensive security, cyber operations, or government research programs is valued
• CVEs, publications, conference talks, CTF results, or malware analysis/deobfuscation work are a plus, not a requirement

Technical Skills

• Expert-level reverse engineering of OS internals, kernels, firmware, and compiled binaries
• Strong assembly-level fluency across x86/x64, ARM, and PowerPC
• Experience developing proof-of-concept exploits and mitigation bypass techniques
• Strong C/C++ and Python
• Exposure to embedded systems, hypervisors, mobile platforms, RTOS, or networking protocols
• Comfort with IDA Pro, Ghidra, fuzzing frameworks, and symbolic execution tools

Clearance & Education

• Active US Top Secret clearance, with eligibility for TS/SCI with Special Access Program
• Bachelor's degree in Computer Science, Computer Engineering, or a related technical field preferred
• U.S. citizenship required; visa sponsorship is not available for this role

Why Candidates Say Yes

• Genuine technical breadth across architectures and target types, not a single narrow lane
• Culture that explicitly rewards technical depth and curiosity over titles or hierarchy
• Independent ownership of research from hypothesis through to validated finding
• Strong compensation band with relocation support

Ready to Apply?

If you've built your career around finding what others miss — and you'd rather be the one writing the exploit than the one patching against it — this team wants to talk to you.

Great Bay Staffing represents candidates with complete confidentiality. Your resume will never be shared with a client without your knowledge and approval.