CVE Security Verification Engineer

Obsidian; San Francisco (CA); On-site; USD 120,000 - 160,000; Full time

Job summary

Obsidian is seeking a security-focused evaluator to assess the quality of vulnerability-reproduction and remediation tasks used to train frontier AI lab models. You will review fidelity of CVE reproductions, soundness of fixes, and the rigor of verification logic, within Docker-based lab environments that recreate exploitable conditions.

The role emphasizes rubric-based written feedback and collaboration with research engineers to improve reproducibility and safety.

Qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research.
• Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC).
• Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQLi, RCE, Buffer overflows, deserialization, SSRF, misconfigurations, privilege escalation).
• Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests).
• Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments.

Skills

Application security

Penetration testing

Vulnerability research

CVE taxonomy knowledge (CVSS, CWE, CAP

Secure coding

Verification logic design

Tools

Docker

Docker Compose

Job description

Obsidian is seeking a security-focused evaluator to assess the quality of vulnerability-reproduction and remediation tasks used to train frontier AI lab models. You will review fidelity of CVE reproductions, soundness of fixes, and the rigor of verification logic, within Docker-based lab environments that recreate exploitable conditions.

The role emphasizes rubric-based written feedback and collaboration with research engineers to improve reproducibility and safety.