Vulnerability Analyst

Carnegie Mellon University•Pittsburgh, PA

3d•Onsite

About The Position

The Vulnerability Analyst will join the Software Engineering Institute’s CERT Division, within the Threat Analysis Directorate, to conduct applied cybersecurity research supporting national security. The team works collaboratively across areas including AI security, advanced malware analysis and reverse engineering, and vulnerability analysis. Its mission is to advance methods for analyzing, assuring, and countering software systems. The role applies state-of-the-art approaches to understanding systemic software vulnerabilities and how attackers adapt their tradecraft. It evaluates security tools, techniques, and processes; develops models, tools, and datasets to characterize software threats and vulnerabilities; and creates machine-learning-based prototypes and tools to address AI security problems. The analyst translates research into practical operational capabilities, working independently and collaboratively, and communicates technical advice to managers, technical staff, and customers. The position is based in Arlington, Virginia, or Pittsburgh, Pennsylvania. It includes travel of approximately 25% to SEI offices, sponsor sites, conferences, and offsite meetings. The employee will be subject to a background investigation and must be able to obtain and maintain a Department of War security clearance.

Requirements

Bachelor’s degree in computer science, machine learning, cybersecurity, or a related discipline and eight years of experience; or a master’s degree in the same fields and five years of experience; or a Ph.D. in the same fields and two years of experience.
Hands-on experience in AI-based research, vulnerability research and analysis, and statistical modeling.
Knowledge of rigorous research methods in computer science, engineering, security, AI, or related fields.
Knowledge of internet fundamentals, including network protocols, provider operations, and governance.
Experience developing software in Python and other modern programming languages.
Experience developing AI/ML solutions for use outside the lab and moving prototypes toward practical use.
Knowledge of cybersecurity best practices and how internet infrastructure connects to AI systems and risk.
Ability to provide sound security advice and clearly communicate complex technical approaches in writing and in person.
Ability to collaborate diplomatically, organize complex projects, and handle confidential and sensitive information with care.
Willingness to travel approximately 25%.
Ability to obtain and maintain a Department of War security clearance; subject to a background investigation.

Responsibilities

Apply state-of-the-art approaches to understand systemic vulnerabilities in software systems and how attackers adapt their tradecraft to exploit them.
Evaluate the effectiveness of tools, techniques, and processes developed by industry and the security research community.
Develop models, tools, and datasets to characterize threats to and vulnerabilities in software systems, and publish results.
Develop machine-learning-based prototypes, products, and tools to solve and automate solutions to AI-related security problems.
Translate research concepts into practical, operational capabilities, working independently and as part of a collaborative team.
Provide sound, research-grounded advice on security topics and explain complex technical approaches clearly to managers, technical staff, and customers.
Plan and organize complex projects, collaborate diplomatically with internal and external colleagues, and handle confidential and sensitive information carefully.
Travel approximately 25% to other SEI offices, sponsor sites, conferences, and offsite meetings.