Application Security Engineer – CVE & Vulnerability Research

Hidden Jobs; United States; Remote; USD 96,000 - 152,000; Part time

Benefits offered by this job

Fully remote

Part-time project-based engagement

Job summary

anyone-ai in the United States is seeking a part-time, remote, project-based security consultant to review real-world vulnerabilities, CVE reproductions, remediation approaches, and exploit verification environments.

You will evaluate fixes, review test suites to ensure original exploits no longer succeed, audit Docker-based environments, and deliver clear, technically rigorous recommendations based on 3+ years in application security and vulnerability research.

Qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research.
• Strong understanding of CVE, CVSS, CWE, and common vulnerability classes.
• Experience reviewing or developing exploit proof-of-concepts.
• Proficiency with Docker and Docker Compose for building vulnerable environments.
• Ability to produce clear, technically rigorous written feedback.

Responsibilities

• Review CVE reproduction environments for technical accuracy and faithful reproduction of the original attack vector and impact.
• Evaluate proposed security fixes and remediation strategies for root cause alignment.
• Review test suites to ensure application functionality remains intact and exploits are mitigated.
• Identify incomplete fixes and alternative exploitation paths, including potential regressions.
• Audit Docker-based environments for correct software versions, services, networking, and configuration.
• Provide clear, technically rigorous written recommendations for improvements.

Skills

Application security

Penetration testing

Vulnerability research

Tools

Docker

Docker Compose

Python

Requests

Curl

Pwntools

Job description

Role overview

This part-time, project-based consulting role focuses on reviewing real-world software vulnerabilities, CVE reproductions, remediation approaches, and exploit verification environments. The work is remote and well suited to security professionals who enjoy analyzing how vulnerabilities actually work and identifying subtle gaps that traditional testing may miss.

Responsibilities

• Review CVE reproduction environments for technical accuracy and faithful reproduction of the original attack vector and impact.
• Evaluate proposed security fixes and remediation strategies to determine whether they address the root cause.
• Review test suites that confirm normal application functionality remains intact and that the original exploit no longer succeeds.
• Identify incomplete fixes and alternative exploitation paths, including potential regressions introduced by a patch.
• Audit Docker-based environments for correct software versions, services, networking, and configuration.
• Provide clear, technically rigorous written recommendations for improving vulnerability reproductions, fixes, and verification logic.

Requirements

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research.
• Strong understanding of CVE, CVSS, CWE, and common vulnerability classes such as SQL injection, command injection, SSRF, deserialization flaws, buffer overflows, privilege escalation, access control issues, and security misconfigurations.
• Demonstrated experience with secure coding practices and vulnerability remediation.
• Track record of reviewing or developing exploit proof-of-concepts.
• Proficiency with Docker and Docker Compose for building and inspecting vulnerable environments.
• Ability to produce clear, technically rigorous written feedback.

Nice to have

• OSCP, GPEN, GWAPT, or equivalent security certifications.
• Experience with responsible vulnerability disclosure or CVE reporting, or maintaining exploit proof-of-concept code.
• Familiarity with automated security testing using Python, requests, curl, pwntools, or custom exploit harnesses.
• DevSecOps experience and familiarity with SAST, DAST, and CI/CD security tooling.
• Experience developing or reviewing cybersecurity assessments, technical security challenges, or AI evaluation and RLHF projects.

Benefits and work setup

• Fully remote, part-time, project-based consulting engagement focused on application security and vulnerability research.