Principal Security Researcher

Oracle•Nashville, TN

6h•$114,600 - $234,600

About The Position

Oracle is seeking a Principal Security Researcher for its security research organization. The role investigates complex software and systems, conducts vulnerability research, and develops AI-assisted tools that help researchers address challenging security questions. The researcher owns projects from initial investigation through delivery of validated findings, reproducible technical evidence, and reusable research capabilities. The work emphasizes technical depth, careful experimentation, and clear communication of findings, limitations, and organizational relevance.

Requirements

Meet one of the following education and experience combinations: a bachelor's degree and 7 years of relevant experience; a master's degree and 5 years; a doctorate and 3 years; or 11 years of relevant experience without those degree combinations.
Relevant education fields include computer science, electrical engineering, cybersecurity, mathematics, or related disciplines; relevant experience includes security research, security assessments, penetration testing, software engineering, software architecture, or related technical work.
Demonstrated contributions to security research or research tooling, with the ability to explain technical approach, individual contribution, and results. Evidence may include validated findings, analysis tools, technical reports, or comparable public or confidential work.
Deep expertise in one or more areas such as binary analysis, application security, operating system security, cloud security, virtualization, network protocols, fuzzing, or program analysis.
Strong programming skills for developing research tools and proofs of concept, including proficiency in a language such as Python and the ability to analyze code in languages relevant to the research area.
Practical experience with debuggers, disassemblers, decompilers, instrumentation frameworks, or comparable tools, and a strong understanding of vulnerability classes, exploitation principles, and defensive mitigations.
Ability to independently investigate ambiguous problems, design reproducible experiments, distinguish evidence from assumptions, and document limitations.
Clear technical communication, effective collaboration with researchers and stakeholders, and sound judgment when handling sensitive findings and conducting authorized research.

Nice To Haves

Experience developing LLM-based research tools or AI agents that interact with code repositories, debuggers, analysis tools, and test environments.
Experience creating evaluation datasets, automated validation systems, or benchmarks for security research automation.
Experience discovering zero-day vulnerabilities or contributing novel security research methods, exploitation techniques, or insights into emerging attack surfaces.
Experience analyzing native code and assembly, investigating memory corruption, or researching kernels, hypervisors, containers, and isolation boundaries.
Experience supporting client-sponsored security research, presenting complex findings, and handling confidential technical information.
Experience mentoring researchers or guiding investigations that advanced a team's research methods or technical capabilities.

Responsibilities

Build AI-assisted research tools by connecting large language models and AI agents to code analysis and testing tools, and develop workflows for examining unfamiliar software, investigating suspected flaws, and testing reasoning against observed behavior.
Investigate applications, cloud services, and infrastructure using static and dynamic analysis, including source code review, binary reverse engineering, fuzzing, and debugging; identify security boundary failures and their causes.
Conduct original security research, including discovering previously unknown vulnerabilities and zero-days, developing new investigative methods, and exploring emerging attack surfaces and vulnerability classes.
Validate findings and demonstrate impact through reproducible proofs of concept and controlled exploits that establish prerequisites and realistic consequences; preserve evidence for independent reproduction and assessment.
Develop reusable research infrastructure, including target-configuration and test-execution automation, fuzzing harnesses, and shared analysis components that work across software versions and can be used by other researchers.
Measure and improve research automation using benchmarks and independent checks; analyze crashes, incorrect findings, and unsuccessful investigations to improve workflow accuracy and coverage.
Communicate research to stakeholders through technical briefings that explain findings, evidence, limitations, and open questions, and identify opportunities for further investigation.
Lead research projects by selecting investigations, defining objectives, managing technical uncertainty, communicating progress and tradeoffs, adjusting priorities as evidence develops, and delivering results and tools aligned with organizational needs.
Share expertise and strengthen the team by reviewing technical work, documenting methods, mentoring colleagues, and contributing to technical publications, conference presentations, and open-source projects when appropriate and approved.