Vulnerability Analyst

Carnegie Mellon University•Pittsburgh, PA

20h

About The Position

The Vulnerability Analyst will join the Software Engineering Institute’s CERT Division, within the Threat Analysis Directorate, which conducts applied cybersecurity research to address national security challenges. The role focuses on understanding systemic software vulnerabilities and how attackers adapt their tradecraft, evaluating security tools and methods, and developing models, tools, and datasets to characterize threats and vulnerabilities. The analyst will also develop machine learning-based prototypes and tools for AI-related security problems and translate research into practical operational capabilities. The work involves independent contributions and collaboration with internal and external partners.

Requirements

Bachelor’s degree in computer science, machine learning, cybersecurity, or a related discipline and eight years of experience; or a master’s degree in the same fields and five years of experience; or a Ph.D. in the same fields and two years of experience.
Hands-on experience in AI-based research, vulnerability research and analysis, and statistical modeling.
Understanding of rigorous research methods in computer science, engineering, security, AI, or related fields.
Knowledge of internet fundamentals, including network protocols, provider operations, and governance.
Experience developing software in Python and other modern programming languages.
Experience building AI/ML solutions that can be used beyond the laboratory, including moving prototypes toward practical use.
Knowledge of cybersecurity best practices.
Ability to communicate complex technical approaches clearly in writing and in person.
Ability to work collaboratively and diplomatically with people inside and outside the organization.
Willingness to travel approximately 25%.
Ability to obtain and maintain a Department of War security clearance; employment is subject to a background investigation.

Responsibilities

Apply state-of-the-art approaches to understand systemic vulnerabilities in software systems and how attackers adapt their tradecraft to exploit them.
Evaluate the effectiveness of tools, techniques, and processes developed by industry and the security research community.
Develop models, tools, and datasets to characterize threats to and vulnerabilities in software systems, and publish results.
Develop machine learning-based prototypes, products, and tools to solve and automate solutions to AI-related security problems.
Translate research concepts into practical, operational capabilities, working independently and collaboratively.
Provide sound advice on security topics and explain complex technical approaches clearly to managers, technical staff, and customers.
Plan and organize complex projects and handle confidential and sensitive information with care.
Travel approximately 25% to other SEI offices, sponsor sites, conferences, and offsite meetings.