Vulnerability Researcher

Delta Dental•United States,

6d•$142,077 - $307,899•Remote

About The Position

The Vulnerability Researcher analyzes systems, software, architectures, and strategies to discover impactful, previously unknown vulnerabilities and security weaknesses, including those affecting AI/ML systems and AI-enabled technologies and services. The research proactively identifies vulnerability classes and exploitation opportunities to inform mitigation strategies and secure design. The role includes manual source code review, binary analysis, vulnerability assessments, dynamic testing, threat modeling, and security architecture review. The researcher analyzes real-world adversaries, exploitation methods, emerging attack surfaces, and offensive security techniques to guide research priorities, and develops custom tooling and automation to augment manual vulnerability discovery.

Requirements

At least 7 years of professional cybersecurity industry experience with a bachelor's degree in Computer Science, Management Information Systems, or a related field, or equivalent work experience.
Understand all phases of adversary emulation operations, including reconnaissance, social engineering, exploitation, post-exploitation, covert techniques, lateral movement, and data exfiltration.
Extensive experience in offensive cybersecurity roles, such as red teaming, penetration testing across web, infrastructure, or cloud, and purple team exercises across cloud and on-premises environments.
Strong understanding of contemporary security theory, application exploitation techniques, attack vectors, the vulnerability lifecycle, and scanning methodologies such as SAST, DAST, IAST, and RASP.
Experience developing and managing testing methodologies aligned with security guidelines such as OWASP and frameworks such as NIST 800 or MITRE ATT&CK.
Strong understanding of computer architecture and organization relating to binary analysis and exploitation.
Ability to analyze, create, and debug shellcode and other low-level exploits.
Experience developing custom offensive or defensive security software in one or more compiled languages.
Ability to reverse engineer binaries, identify vulnerabilities in compiled software, and provide working exploits, demonstrated through examples such as CVEs, public acknowledgements, or an on-demand demonstration.
Familiarity with automated security analysis and fuzzing tools such as AFL and Peach.
Ability to discover vulnerabilities through static analysis and source code review.
Working understanding of programming languages and frameworks such as Java, Node.js, Python, and JSP, including ability to learn new languages quickly, understand their security implications, and identify vulnerabilities in custom-developed software packages.
Familiarity with scripting and programming in Python, PowerShell, or C#, including ability to create and customize tools.
Excellent written and verbal communication skills, including technical writing, documentation development, process mapping, and visualization.
Ability to communicate technical concepts effectively to technical and non-technical audiences across roles and levels.
Strong analytical and problem-solving skills, including the ability to examine issues strategically and analytically.
Ability to work collaboratively and interact effectively with coworkers and external contacts.
Ability to manage multiple simultaneous initiatives and prioritize workload to meet commitments.
Self-motivated, with a strong sense of urgency, an adaptive mindset, and demonstrated ability to learn quickly.
Must provide proof of eligibility to work in the United States if selected for hire; the employer does not sponsor work visas.

Responsibilities

Research applications and technologies, including AI-enabled applications and services, to identify highly impactful, unknown vulnerabilities.
Perform vulnerability assessments across environments including web applications, APIs, and cloud infrastructure, using industry best practices.
Develop and manage testing methodologies aligned with common security guidelines and NIST standards.
Evaluate cloud security configurations, identify prevalent vulnerabilities in cloud security controls, and improve and maintain cloud testing standards.
Provide detailed reports with vulnerability proof, guidance, and advice to support customer teams through remediation.
Develop and communicate comprehensive, accurate reports and presentations for client stakeholders, including technical staff and executive leadership.
Keep management informed about developments within assigned responsibilities and perform special projects as required.
Research and develop innovative techniques, tools, and methodologies for vulnerability research and red team activities.
Develop leadership-level communications, including management-specific metrics, white papers, procedures, and thought position papers.
Perform other cybersecurity-congruent duties as requested or assigned.