Vulnerability Researcher

Delta Dental•San Francisco, CA

About The Position

The Vulnerability Researcher analyzes systems, software, architectures, and strategies to discover impactful, previously unknown vulnerabilities and security weaknesses, including those affecting AI/ML systems and AI-enabled technologies and services. The role proactively identifies vulnerability classes and exploitation opportunities to inform mitigation strategies and secure design. The work includes manual source code review, binary analysis, vulnerability assessments, dynamic testing, threat modeling, and security architecture review. The researcher analyzes real-world adversaries, exploitation methods, emerging attack surfaces, and offensive security techniques to guide research priorities, and develops custom tools and automation to augment manual vulnerability discovery.

Requirements

At least 7 years of professional cybersecurity industry experience with a bachelor's degree in Computer Science, Management Information Systems, or a related field, or equivalent work experience.
Understand all phases of adversary emulation operations, including reconnaissance, social engineering, exploitation, post-exploitation, covert techniques, lateral movement, and data exfiltration.
Extensive experience in offensive cybersecurity roles, such as red teaming, penetration testing across web, infrastructure, or cloud environments, and purple team exercises in cloud and on-premises environments.
Robust understanding of contemporary security theory, application exploitation techniques, attack vectors, the vulnerability lifecycle, and scanning methodologies such as SAST, DAST, IAST, and RASP.
Experience developing and managing testing methodologies aligned with common security guidelines such as OWASP and frameworks such as NIST 800 or MITRE ATT&CK.
Solid understanding of computer architecture and organization related to binary analysis and exploitation.
Ability to analyze, create, and debug shellcode and other low-level exploits.
Experience developing custom offensive or defensive security software in one or more compiled languages.
Demonstrated ability to reverse engineer binaries, identify vulnerabilities in compiled software, and provide working exploits, such as CVEs or public acknowledgements, or demonstrate this ability on demand.
Familiarity with automated security analysis and fuzzing tools such as AFL and Peach.
Demonstrated ability to discover vulnerabilities through static analysis and source code review.
Working understanding of programming languages and frameworks such as Java, Node.js, Python, and JSP, including the ability to learn new languages quickly, understand their security implications, and identify vulnerabilities in custom-developed software packages.
Familiarity with scripting and programming in Python, PowerShell, or C#, and ability to create and customize tools.
Excellent written and verbal communication skills, including technical writing, documentation development, process mapping, and visualization.
Ability to communicate technical concepts effectively to technical and non-technical audiences across roles and levels.
Strong analytical and problem-solving skills, including the ability to examine issues strategically and analytically.
Ability to work collaboratively and interact effectively with coworkers and external contacts.
Ability to manage multiple simultaneous initiatives and prioritize workload to meet commitments.
Self-motivated, with a strong sense of urgency, an adaptive mindset, and demonstrated ability to learn quickly.

Responsibilities

Research a wide variety of applications and technologies, including AI-enabled applications and services, to identify highly impactful, unknown vulnerabilities.
Conduct vulnerability assessments across environments such as web applications, APIs, and cloud infrastructure, using industry best practices.
Develop and manage testing methodologies aligned with common security guidelines and NIST standards.
Evaluate cloud security configurations, identify prevalent vulnerabilities in cloud security controls, and improve and maintain cloud testing standards.
Provide detailed vulnerability reports, proof of vulnerabilities, and guidance to support customer teams through remediation.
Develop and communicate accurate reports and presentations for client stakeholders, including technical staff and executive leadership.
Maintain communication with management about developments within assigned responsibilities and perform special projects as required.
Research and develop innovative techniques, tools, and methodologies for vulnerability research and red team activities.
Develop leadership-level communications, including management-specific metrics, white papers, procedures, and thought position papers.
Perform other cybersecurity-congruent duties as requested or assigned.