Principal Security Researcher

Oracle•Nashville, TN

About The Position

Oracle is seeking a Principal Security Researcher to investigate complex software and systems, conduct vulnerability research, and develop AI-assisted tools that expand the organization’s ability to answer challenging security research questions. The role owns research projects from initial investigation through delivery of validated findings, reproducible technical evidence, and reusable research capabilities. It calls for technical depth, careful experimentation, and clear communication of what research demonstrates, its limitations, and its relevance to organizational priorities. The researcher will build AI-assisted workflows connecting large language models and AI agents with code analysis and testing tools; use static and dynamic analysis to examine applications, cloud services, and infrastructure; conduct original vulnerability research; and create reproducible proofs of concept and controlled exploits. The role also develops reusable research infrastructure, evaluates and improves automation, communicates findings to stakeholders, leads investigations, and strengthens the team through review, documentation, mentoring, and appropriate contributions to publications, presentations, and open-source projects.

Requirements

Relevant education and experience meeting one of these combinations: a bachelor’s degree and 7 years of relevant experience; a master’s degree and 5 years; a doctorate and 3 years; or 11 years of relevant experience without one of those degree combinations.
Relevant education fields include computer science, electrical engineering, cybersecurity, mathematics, or related disciplines; relevant experience includes security research, security assessments, penetration testing, software engineering, software architecture, or related technical work.
Demonstrated contributions to security research or research tooling, with the ability to explain the technical approach, individual contribution, and results. Evidence may include validated findings, analysis tools, technical reports, or comparable public or confidential work.
Deep expertise in one or more areas such as binary analysis, application security, operating system security, cloud security, virtualization, network protocols, fuzzing, or program analysis.
Strong programming skills for developing research tools and proofs of concept, including proficiency in a language such as Python and the ability to analyze code in languages relevant to the research area.
Practical experience with debuggers, disassemblers, decompilers, instrumentation frameworks, or comparable tools, supported by a strong understanding of vulnerability classes, exploitation principles, and defensive mitigations.
Ability to independently investigate ambiguous problems, design reproducible experiments, distinguish evidence from assumptions, and document limitations.
Clear technical communication, effective collaboration with researchers and stakeholders, and sound judgment in handling sensitive findings and conducting authorized research.

Nice To Haves

Experience developing LLM-based research tools or AI agents that interact with code repositories, debuggers, analysis tools, and test environments.
Experience creating evaluation datasets, automated validation systems, or benchmarks for security research automation.
Experience discovering zero-day vulnerabilities or contributing novel security research methods, exploitation techniques, or insights into emerging attack surfaces.
Experience analyzing native code and assembly, investigating memory corruption, or researching kernels, hypervisors, containers, and isolation boundaries.
Experience supporting client-sponsored security research, presenting complex findings, and handling confidential technical information.
Experience mentoring researchers or guiding investigations that advanced a team’s research methods or technical capabilities.

Responsibilities

Build AI-assisted research tools by connecting large language models and AI agents to code analysis and testing tools, and develop workflows for examining unfamiliar software, investigating suspected flaws, and testing hypotheses against observed behavior.
Investigate complex software and systems using techniques such as source code review, binary reverse engineering, fuzzing, and debugging to assess applications, cloud services, and infrastructure; identify security boundary failures and their causes.
Conduct original security research, including discovering previously unknown vulnerabilities and developing novel methods to investigate difficult targets and emerging attack surfaces.
Validate findings and demonstrate impact with reproducible proofs of concept and controlled exploits that establish prerequisites and realistic consequences, preserving evidence needed for independent reproduction and assessment.
Develop reusable research infrastructure, including target-configuration and test-execution automation, fuzzing harnesses, and shared analysis components; make experiments repeatable across software versions and usable by other researchers.
Measure and improve research automation using benchmarks and independent checks; analyze crashes, incorrect findings, and unsuccessful investigations to improve workflow accuracy and coverage.
Communicate findings, evidence, limitations, and open questions through technical briefings and stakeholder discussions, and identify opportunities for further investigation.
Lead research projects by selecting promising investigations, defining objectives, managing technical uncertainty, communicating progress and tradeoffs, adjusting priorities as evidence develops, and delivering results and tools aligned with organizational needs.
Review technical work, document research methods, mentor colleagues, and contribute to technical publications, conference presentations, and open-source projects when appropriate and approved.

Benefits

Medical, dental, and vision insurance, including expert medical opinion
Short-term and long-term disability
Life insurance and AD&D
Supplemental life insurance for employees, spouses, and children
Health care and dependent care Flexible Spending Accounts
Pre-tax commuter and parking benefits
401(k) Savings and Investment Plan with company match
Paid time off, including flexible vacation for eligible salaried non-overtime positions or accrued vacation for other eligible employees
11 paid holidays
Paid sick leave
Paid parental leave
Adoption assistance
Employee Stock Purchase Plan
Financial planning and group legal benefits
Voluntary auto, homeowner, and pet insurance