Vulnerability Analyst

Software Engineering Institute | Carnegie Mellon University • Pittsburgh, PA

3d • Onsite

About The Position

SEI conducts applied research and development in software engineering, cybersecurity, and AI in support of government sponsors. The SEI works closely with defense and government organizations, industry, and academia to improve and secure software-intensive systems. Its purposes include improving software engineering capabilities, advancing cybersecurity methods and technologies, and bringing software engineering discipline to AI systems.

The Vulnerability Analyst will join the Threat Analysis Directorate in the CERT Division, a collaborative team of approximately 40 professionals conducting applied cybersecurity research in areas including AI security, advanced malware analysis and reverse engineering, and vulnerability analysis. The directorate advances methods for analyzing, assuring, and countering software systems to address national security challenges.

The role applies state-of-the-art approaches to understanding systemic software vulnerabilities and attacker tradecraft; evaluates security tools, techniques, and processes; develops models, tools, and datasets to characterize threats and vulnerabilities; and creates machine-learning-based prototypes, products, and tools for AI-related security problems. The analyst translates research concepts into practical operational capabilities and works independently as well as collaboratively.

The position is based in Arlington, Virginia, or Pittsburgh, Pennsylvania. It is a regular, full-time staff position with a salary pay basis. Travel of 25% is expected. The employee will undergo a background investigation and must be able to obtain and maintain a Department of War security clearance.

Requirements

• Bachelor’s degree in computer science, machine learning, cybersecurity, or a related discipline and eight years of experience; or a master’s degree in those fields and five years of experience; or a Ph.D. in those fields and two years of experience.
• Hands-on experience in AI-based research, vulnerability research and analysis, and statistical modeling.
• Understanding of rigorous research methods in computer science, engineering, security, AI, or related fields.
• Knowledge of internet fundamentals, including network protocols, provider operations, and governance.
• Experience developing software in Python and other modern programming languages.
• Experience building AI/ML solutions that are used outside the lab and taking prototypes into practical use.
• Knowledge of cybersecurity best practices and how the internet works.
• Ability to provide sound technical advice on security topics and explain complex technical approaches clearly, in writing and in person, to managers, technical staff, and customers.
• Ability to collaborate and work diplomatically with people inside and outside the organization.
• Ability to plan and organize complex projects and handle confidential and sensitive information carefully.
• Willingness to travel 25% outside the office location.
• Subject to a background investigation and must be able to obtain and maintain a Department of War security clearance.

Responsibilities

• Apply state-of-the-art approaches to understand systemic vulnerabilities in software systems and how attackers adapt their tradecraft to exploit them.
• Evaluate the effectiveness of tools, techniques, and processes developed by industry and the security research community.
• Develop models, tools, and datasets to characterize threats to and vulnerabilities in software systems, and publish results.
• Develop machine-learning-based prototypes, products, and tools to solve and automate solutions to AI-related security problems.
• Translate research concepts into practical, operational capabilities.
• Work independently and as part of a collaborative team.
• Travel to other SEI offices, sponsor sites, conferences, and offsite meetings as needed.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior