Cyber Vulnerability Researcher

Lumbee Tribe Holdings, Inc.•Camp Pendleton North, CA

3d•$110,000 - $120,000•Onsite

About The Position

The Cyber Vulnerability Researcher delivers advanced vulnerability research and low-level exploit development in support of the MCTSSA Cyber Branch’s adversarial testing mission. The role extends offensive assessment capabilities beyond tool-based penetration testing through original vulnerability discovery, binary analysis, and exploitation of embedded systems, real-time operating systems, and custom platform architectures. The researcher coordinates closely with the Vulnerability Assessment Analyst and Penetration Tester team to translate research findings into actionable assessment products and technically defensible remediation recommendations for Program Offices. The position is full-time and requires on-site support at MCTSSA Cyber Branch at Camp Pendleton, California. Work is generally Monday through Friday during established core hours, typically 0800–1600, excluding Government holidays. Schedules may vary to meet customer, mission, operational, and tempo requirements. Travel is anticipated to be less than 10% within the Continental United States. The role is primarily sedentary in an office or secured laboratory, potentially involving classified systems and materials. An active DoD Secret clearance is required; the ability to obtain and maintain Top Secret is preferred. Compensation is commensurate with experience and qualifications.

Requirements

Ability to code in C or C++ and use a scripting language such as Python, Perl, or Ruby.
Experience with PC and embedded systems architecture, including boot processes and OS internals.
Five or more years of experience with Ghidra for vulnerability research.
Advanced understanding of network protocols.
Experience with one or more assembly languages, including x86, x64, ARM, MIPS, or PowerPC, and debuggers such as WinDbg, OllyDbg, or gdb.
Experience conducting vulnerability research on one or more operating systems, such as Android, Windows, Linux, VxWorks, RTOSs, or custom operating systems.
Knowledge of common mitigation techniques, including DEP, ASLR, and stack canaries, and fuzzing techniques; ability to engineer and execute fuzz tests.
Active DoD Secret clearance; ability to obtain and maintain Top Secret is preferred.

Nice To Haves

Experience developing IDA Pro plugins and scripts.
Knowledge of wired and wireless network protocol structures.
Active participation in CTF or software hacking competitions.
Experience developing on and debugging embedded systems, real-time operating systems, and FPGAs.
Ten or more years of low-level systems programming, analysis, and reverse engineering experience.
Experience leading and tasking engineering teams through technical design and delivery.
Advanced certifications such as OSED, OSEE, GREM, or equivalent.
Ability to obtain and maintain a Top Secret clearance.

Responsibilities

Conduct original vulnerability research using static and dynamic analysis tools to identify exploitable weaknesses in Marine Corps system software, firmware, and embedded platforms.
Develop and execute fuzz testing campaigns against target systems and applications; document findings in sufficient detail for replication and remediation.
Research and analyze CVEs, publicly known exploits, and adversary TTPs relevant to assessed systems, and prepare Vulnerability Survey Reports for requesting Program Offices within one to two weeks of request.
Develop proof-of-concept exploits in isolated research environments to validate exploitability and assess mission impact.
Analyze assembly code across target architectures to identify logic flaws, memory corruption vulnerabilities, and ways to bypass common mitigations.
Research vulnerabilities in embedded systems, real-time operating systems, and custom operating systems used in Marine Corps weapons systems and C5ISR platforms.
Collaborate with the Vulnerability Assessment Analyst and Penetration Tester team to integrate research-derived findings into assessments and, where approved, validate them against live systems.
Automate vulnerability research and analysis using Python, Perl, Ruby, or C/C++.
Communicate technical research results to technical and non-technical audiences, including Program Offices, system engineers, and DCO stakeholders.
Prepare presentations and technical research reports covering findings, exploit development methodology, attack path analysis, and recommended mitigations in compliance with applicable Security Classification Guides.
Keep current with vulnerability research techniques, reverse engineering methodologies, exploit development frameworks, and adversary tradecraft, and apply this knowledge to advance the Cyber Branch’s research capability.
Conduct static and dynamic analysis of source code repositories and executables to identify CWEs, insecure coding patterns, and exploitable logic flaws.
Produce Code Review Reports identifying vulnerabilities by location and severity, assessing mission impact, and recommending remediation and secure coding practices.
Deliver a summary Security Posture Assessment for each reviewed software component for program management and test and evaluation documentation.
Represent the team at technical working groups, program meetings, and coordination events as directed by the Government.
Perform additional duties as assigned by the Program Manager.