Vulnerability Research Analyst

Overview of Opportunity

We are seeking a Vulnerability Research Analyst to conduct software security evaluations using state-of-the-art AI evaluation harnesses. This position focuses purely on analyzing extracted source code and compiled binaries from specialized COTS/GOTS systems, evaluating automated vulnerability-finding performance, and assessing system resilience without needing direct hardware-level manipulation.

Key Responsibilities & Duties

• Perform static and dynamic software vulnerability analysis on pre-extracted COTS/GOTS source code repositories and firmware images.
• Deploy AI-guided fuzzing and automated vulnerability detection suites to evaluate complex software architectures and identify high-risk logic flaws.
• Validate automated tool output by tracing execution paths in code to determine root causes and real-world exploitability.
• Develop custom CodeQL queries, Semgrep rules, and Abstract Syntax Tree (AST)-based detection signatures to codify newly discovered bug patterns and automate regression testing across software evaluations.
• Present vulnerability perspectives, risk assessments, and testing metrics to program managers, stakeholders, and intelligence community partners.

Qualifications & Skills

• Active US Security Clearance of Top Secret/SCI with polygraph
• Degree in Computer Science, Computer Engineering, Information Security, or equivalent practical experience.
• Experience in vulnerability research, static source code analysis, reverse engineering, or software security audits.
• Solid understanding of memory management, pointer arithmetic, and common software security flaws in compiled and managed languages.
• Familiarity with automated static/dynamic code analysis concepts and AI-driven automation tools.

Nice to Have

• Experience authoring or tuning custom static analysis rules using CodeQL, Semgrep, or Tree-sitter parsers.
• Familiarity with firmware emulation tools and frameworks (e.g., QEMU, Unicorn Engine, Avatar2, or Ghidra/IDA emulator plugins) to run extracted binaries without physical hardware.
• Experience creating or adapting custom test drivers, stubs, and harness interfaces for unit-level software execution.
• Knowledge of machine learning applications in automated bug discovery, symbolic execution, or AI-assisted code analysis.
• Prior experience delivering technical vulnerability assessments on DoD or IC defense programs.

Clearance Requirements:

• Active US Security Clearance of Top Secret/SCI with polygraph.
• Must be willing to obtain and maintain a Polygraph clearance.

#LI-CM1

#LI-ONSITE