Overview of Opportunity
We are seeking a Vulnerability Research Analyst to conduct software security evaluations using state-of-the-art AI evaluation harnesses. This position focuses purely on analyzing extracted source code and compiled binaries from specialized COTS/GOTS systems, evaluating automated vulnerability-finding performance, and assessing system resilience without needing direct hardware-level manipulation.
Key Responsibilities & Duties
- Perform static and dynamic software vulnerability analysis on pre-extracted COTS/GOTS source code repositories and firmware images.
- Deploy AI-guided fuzzing and automated vulnerability detection suites to evaluate complex software architectures and identify high-risk logic flaws.
- Validate automated tool output by tracing execution paths in code to determine root causes and real-world exploitability.
- Develop custom CodeQL queries, Semgrep rules, and Abstract Syntax Tree (AST)-based detection signatures to codify newly discovered bug patterns and automate regression testing across software evaluations.
- Present vulnerability perspectives, risk assessments, and testing metrics to program managers, stakeholders, and intelligence community partners.
Qualifications & Skills
- Active US Security Clearance of Top Secret/SCI with polygraph
- Degree in Computer Science, Computer Engineering, Information Security, or equivalent practical experience.
- Experience in vulnerability research, static source code analysis, reverse engineering, or software security audits.
- Solid understanding of memory management, pointer arithmetic, and common software security flaws in compiled and managed languages.
- Familiarity with automated static/dynamic code analysis concepts and AI-driven automation tools.
Nice to Have
- Experience authoring or tuning custom static analysis rules using CodeQL, Semgrep, or Tree-sitter parsers.
- Familiarity with firmware emulation tools and frameworks (e.g., QEMU, Unicorn Engine, Avatar2, or Ghidra/IDA emulator plugins) to run extracted binaries without physical hardware.
- Experience creating or adapting custom test drivers, stubs, and harness interfaces for unit-level software execution.
- Knowledge of machine learning applications in automated bug discovery, symbolic execution, or AI-assisted code analysis.
- Prior experience delivering technical vulnerability assessments on DoD or IC defense programs.
Clearance Requirements:
- Active US Security Clearance of Top Secret/SCI with polygraph.
- Must be willing to obtain and maintain a Polygraph clearance.
#LI-CM1
#LI-ONSITE