Senior Vulnerability Researcher

National Physical Laboratory; Birmingham; Hybrid; GBP 65,000 - 85,000; Full time

Job summary

The National Physical Laboratory is seeking a senior researcher in telecom security in Birmingham. You will lead advanced vulnerability research into telecom systems, shape the technical strategy, and mentor a team of researchers.

Candidates must have proven experience with telecom technologies and a deep understanding of software and hardware security risks. This role offers flexible work arrangements.

Qualifications

• Proven experience leading or contributing to advanced vulnerability research initiatives.
• Strong expertise across telecom technologies such as 4G/5G, fibre broadband, and OpenRAN.
• Deep understanding of hardware and software development lifecycles introducing security risks.
• Practical knowledge of cryptographic systems, including encryption and authentication.
• Solid grasp of data structures, distributed systems, virtualisation, and containerisation.
• Expert-level understanding of network protocols and software internals.
• Experience with embedded systems and OS internals.
• Strong knowledge of Linux internals.
• Demonstrated experience identifying and exploiting memory corruption vulnerabilities.
• Proficiency in reverse engineering and debugging techniques.
• Experience building custom tools for vulnerability discovery.

Responsibilities

• Lead advanced vulnerability research across telecom systems.
• Define technical direction for vulnerability research.
• Mentor and elevate the research team.
• Apply structured methodologies to understand complex systems.
• Design and develop research tools and environments.

Skills

Leading advanced vulnerability research

Telecom technologies expertise (4G/5G, fibre broadband, OpenRAN)

Understanding of development lifecycles

Knowledge of cryptographic systems

Understanding of data structures and distributed systems

Network protocols expertise

Experience with embedded systems

Knowledge of Linux internals

Experience identifying memory corruption vulnerabilities

Proficiency in reverse engineering

Skill in using debugging tools

Experience building custom tools

Tools

IDA Pro

Ghidra

GDB

Job description

What You’ll Be Doing

Step into a senior position at the forefront of telecom security research. In this role, you won’t just explore vulnerabilities—you’ll define how they are discovered, understood, and mitigated across complex telecom ecosystems. You will lead high-impact research initiatives, guide technical direction, and mentor others while continuing to push the boundaries of your own expertise.

• Lead Vulnerability Research – and take ownership of advanced vulnerability research across carrier‑grade telecom systems. You’ll drive investigations into complex, real‑world technologies, uncovering deep and previously unknown security weaknesses. Your work will directly influence the resilience of critical national infrastructure.
• Set Technical Direction & Strategy – Shape the vision for vulnerability research within the organisation. Define priorities, methodologies, and tooling approaches, ensuring research efforts remain innovative, relevant, and impactful. You will provide technical leadership across multiple domains, guiding teams through ambiguous and complex problem spaces. Innovate & Build at Scale – Design and develop advanced research tooling and environments. Whether creating bespoke fuzzers, software‑defined radio solutions, or entirely new frameworks, you’ll enable large‑scale experimentation and discovery. You’ll lead by example – prototyping, iterating, and pushing technical boundaries.
• Mentor & Elevate the Team – Support and develop other researchers by sharing knowledge, reviewing work, and fostering a culture of curiosity and technical excellence. You’ll help build capability across the team, raising standards and accelerating collective impact.
• Deepen Expertise & Drive Insight – Apply structured research methodologies to understand complex systems—how they behave, where they fail, and how they can be secured. You’ll connect insights across domains (hardware, software, and networks) to solve real‑world security challenges.
• Work, Build & Experiment in a World‑Class Lab – Operate within a cutting‑edge research environment where experimentation is encouraged. You’ll have the freedom to deconstruct systems, explore their limits, and rebuild them more securely—at scale. Alongside this, you’ll design and evolve the infrastructure that underpins advanced telecom security research.

Successful Applicants must be able to commute to the UKTL offices in Birmingham at least twice a week

Location & Availability

We strive to offer a great work life balance—options include full time, part time, or flexible arrangements, depending on the role and business needs.

Skills & Experience

• Proven experience leading or contributing to advanced vulnerability research initiatives across multiple roles or organisations
• Strong expertise across telecom technologies such as 4G/5G, fibre broadband, and OpenRAN
• Deep understanding of hardware and software development lifecycles, and how they introduce security risks
• Practical knowledge of cryptographic systems, including encryption, authentication, and digital signatures
• Solid grasp of data structures, distributed systems, virtualisation, and containerisation
• Expert‑level understanding of network protocols and software internals, from low‑level assembly to high‑level languages
• Experience with embedded systems, OS internals, and hardware debugging techniques
• Strong knowledge of Linux internals, with the ability to quickly adopt new programming languages
• Demonstrated experience identifying and exploiting memory corruption vulnerabilities, including bypassing modern protections (ASLR, stack canaries, etc.)
• Proficiency in reverse engineering, using tools such as IDA Pro, Ghidra, or equivalent
• Skilled in using debugging tools (e.g., GDB) and advanced exploitation techniques
• Experience building custom tools, research platforms, or test environments to support vulnerability discovery

Security Clearance

The role requires DV clearance with no restrictions. You can start with SC clearance while your DV clearance is in progress. You are welcome to apply without already holding the required clearance, but you will not be able to start in post until SC clearance has been successfully granted.