Application Security Specialist - AI Trainer

Mercor; Miami (FL); On-site; USD 120,000 - 180,000; Full time

Job summary

Mercor seeks an experienced security evaluator to assess the quality of vulnerability-reproduction and remediation tasks used to train frontier AI lab models. The role focuses on faithfulness of CVE reproductions, sound fixes, rigorous verification, and Docker-based lab environments that replicate exploitable conditions.

The candidate will provide rubric-based written feedback, drawing on 3+ years in application security, vulnerability research, and secure coding practices to ensure robust

Qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research.
• Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC).
• Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, privilege escalation).
• Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests).
• Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments.

Skills

Application security

Penetration testing

Vulnerability research

Secure coding

Docker

Docker Compose

Tools

Docker

Docker Compose

Job description

Evaluate the quality, fidelity, and completeness of vulnerability-reproduction and remediation tasks used to train and evaluate a frontier AI lab's models. You'll assess whether CVE reproductions are faithful, fixes are sound, verification logic is rigorous, and Docker-based lab environments accurately recreate exploitable conditions — and provide clear, rubric-based written feedback.

Basic Qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
• Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC)
• Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, privilege escalation)
• Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests)
• Proficiency with Docker and Docker Compose for multi‑container vulnerability reproduction environments

Preferred Qualifications

• OSCP, GPEN, GWAPT, or equivalent offensive‑security certification
• Experience with CVE disclosure, responsible vulnerability reporting, or maintaining exploit proof‑of‑concept code
• Background in DevSecOps, CI/CD security gating, or SAST/DAST tooling
• Prior technical content review, assessment design, or QA for security‑focused engineering tasks