AI-Driven Vulnerability Researcher (NYC On-site)

davidjoseph-co; New York (NY); On-site; USD 220,000 - 350,000; Full time

Benefits offered by this job

Competitive Equity

Job summary

Zealot Labs is hiring a Vulnerability Researcher to design and build agentic systems that autonomously hack real targets across firmware, network stacks, mobile OSes, and IoT. You will wire emulation environments and instrumentation into agent-accessible tool interfaces, crafting end-to-end vulnerability discovery pipelines.

Deep Linux expertise and proficiency with GDB/IDA/Ghidra are required, along with 2–3+ years in C, C++, or Rust.

Qualifications

• Vulnerability research as primary current role.
• Strong reverse engineering and debugger chops (GDB, IDA, or Ghidra).
• 2 to 3+ years C, C++, or Rust systems programming.

Responsibilities

• Own vulnerability discovery end-to-end against real firmware, network stacks, mobile OSes, and IoT targets using emulation stacks, instrumentation, and fuzzing pipelines.
• Wire emulation environments (QEMU, Unicorn, Qiling) and instrumentation tooling (Frida, DynamoRIO) into agent-accessible tool interfaces.
• Design and build evaluation and benchmarking infrastructure that measures whether the agentic vulnerability research pipeline is working.
• Develop and weaponize exploits from discovered vulnerabilities, turning raw findings into working exploit primitives.
• Contribute to agent harness orchestration, tool-use design, and eval loops that power autonomous vulnerability research at scale.
• Collaborate directly with the R&D team to push the boundary of what agents can autonomously discover and exploit across target device classes.

Skills

Vulnerability research

RE/debugger skills

Linux fluency

Tools

GDB

IDA

Ghidra

QEMU

Unicorn

Qiling

PANDA

FirmAE

Frida

DynamoRIO

Job description

Zealot Labs is hiring a Vulnerability Researcher to design and build agentic systems that autonomously hack real targets across firmware, network stacks, mobile OSes, and IoT. You will wire emulation environments and instrumentation into agent-accessible tool interfaces, crafting end-to-end vulnerability discovery pipelines.

Deep Linux expertise and proficiency with GDB/IDA/Ghidra are required, along with 2–3+ years in C, C++, or Rust.