Remote | CVE Vulnerability Researcher — $60–$80/hour

24-Mag • New York, NY

1d • Remote

About The Position

We are sharing a specialised part-time consulting opportunity for experienced vulnerability researchers and application security professionals with strong expertise in CVE analysis, vulnerability reproduction, secure remediation, and security testing. This role focuses on evaluating vulnerability-reproduction and remediation tasks for technical accuracy, realism, completeness, and verification quality. Selected experts will review CVE-based scenarios, proposed fixes, security test logic, and containerised lab environments while providing clear, rubric-based technical feedback.

Requirements

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
• Strong understanding of CVE vulnerability taxonomy and severity frameworks
• Practical knowledge of CVSS, CWE, and CAPEC
• Strong secure-coding and remediation experience across common vulnerability classes
• Experience reviewing or designing security verification logic
• Proficiency with Docker and Docker Compose
• Strong ability to evaluate whether vulnerability reproductions and remediation approaches are technically sound
• Strong written communication and ability to provide precise technical feedback

Nice To Haves

• Experience with responsible vulnerability disclosure or CVE reporting is advantageous
• Experience maintaining security proof-of-concept code is advantageous
• Background in DevSecOps, CI/CD security gating, SAST, or DAST tooling is preferred
• Certifications such as OSCP, GPEN, GWAPT , or equivalent are advantageous
• Previous technical review, security assessment design, or QA experience is preferred

Responsibilities

• Evaluate vulnerability-reproduction tasks based on documented CVEs
• Assess whether scenarios faithfully represent the underlying vulnerability
• Review technical assumptions, affected components, and expected behaviour
• Identify incomplete, inaccurate, or unrealistic reproductions
• Apply practical judgement grounded in hands-on vulnerability research or application security experience
• Review security issues using established vulnerability taxonomies
• Apply frameworks such as CVE, CVSS, CWE, and CAPEC
• Assess vulnerability classification and severity rationale
• Identify incorrect or misleading categorisation
• Evaluate whether reported security impact is supported by the technical evidence
• Review proposed fixes for common application and system vulnerabilities
• Assess remediation approaches involving issues such as SQL injection, command injection, buffer overflow, insecure deserialisation, SSRF, misconfigurations, and privilege escalation
• Determine whether fixes address the underlying security issue rather than only its symptoms
• Identify regressions or functionality problems introduced by remediation
• Evaluate secure coding approaches for technical soundness
• Review verification logic used to confirm vulnerability remediation
• Evaluate paired functionality tests and vulnerability-focused tests
• Assess whether tests demonstrate both preserved application behaviour and removal of the security weakness
• Identify incomplete coverage or misleading validation
• Determine whether verification criteria are sufficiently rigorous and reproducible
• Review vulnerability reproduction environments built with Docker and Docker Compose
• Assess whether multi-container environments accurately reproduce required conditions
• Evaluate configuration, dependencies, networking, and service interactions
• Identify environmental issues that could affect reproducibility
• Review whether lab environments support consistent security evaluation
• Assess whether security scenarios can be reproduced reliably
• Review setup instructions, dependencies, configurations, and expected outcomes
• Identify missing assumptions or inconsistencies affecting repeatability
• Evaluate whether task scope is appropriate and technically complete
• Distinguish environment defects from genuine security findings
• Evaluate application changes from a secure-coding perspective
• Identify incomplete or fragile remediation strategies
• Review whether security fixes maintain intended application functionality
• Assess code and configuration changes for security implications
• Apply practical application-security judgement across different vulnerability classes
• Review workflows involving secure development and vulnerability assessment
• Apply familiarity with SAST, DAST, CI/CD security controls, and DevSecOps practices where relevant
• Assess whether security checks are appropriately integrated into development processes
• Identify gaps in validation or security gating
• Evaluate security engineering recommendations for practical effectiveness
• Assess assigned security tasks against structured technical criteria
• Provide clear written explanations supporting evaluation decisions
• Reference specific reproduction, remediation, testing, or configuration evidence
• Apply evaluation standards consistently across assignments
• Distinguish valid alternative security approaches from technically flawed solutions

Benefits

• Flexible scheduling based on project requirements
• H1-B and STEM OPT support is unavailable for this engagement

What This Job Offers

• Job Type: Part-time
• Career Level: Senior
• Education Level: No Education Listed