CVE Vulnerability & AI Evaluation Specialist

HumanitApp; United States; Hybrid; USD 96,000 - 124,000; Full time

Job summary

HumanitApp is seeking an experienced security evaluation researcher to assess vulnerability reproductions, remediation quality, and verification logic in AI-lab environments. You will review CVE fidelity, fixes, and docker-based labs to ensure exploitable conditions are accurately represented.

The role requires hands-on security experience, knowledge of CVE taxonomy, and ability to deliver rubric-based feedback.

Qualifications

• 3+ years in application security, pentesting or vulnerability research.
• Strong understanding of CVE taxonomy and severity frameworks (CVSS, CWE, CAPEC).
• Secure coding and remediation across common vulnerability classes (SQLi, RCE, buffer overflows, deserialization, SSRF).
• Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests).
• Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments.

Responsibilities

• Evaluate CVE reproductions for fidelity, fixes, and verification rigor.
• Assess Docker-based labs reproducing exploitable conditions.
• Provide rubric-based written feedback on vulnerability reproduction and remediation tasks.

Skills

Application security

Penetration testing

Vulnerability research

CVE taxonomy and CVSS

Verification logic design

2-part verification strategy

Tools

Docker

Docker Compose

Job description

Future projects, not immediate vacancies. Check each network's country and experience requirements.

Evaluate the quality, fidelity, and completeness of vulnerability-reproduction and remediation tasks used to train and evaluate a frontier AI lab's models. You'll assess whether CVE reproductions are faithful, fixes are sound, verification logic is rigorous, and Docker-based lab environments accurately recreate exploitable conditions

and provide clear, rubric-based written feedback.

Basic Qualifications • 3+ years of hands-on experience in application security, penetration testing, or vulnerability research • Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC) • Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, privilege escalation) • Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests) • Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments

Preferred Qualifications • OSCP, GPEN, GWAPT, or equivalent offensive-security certification • Experience with CVE disclosure, responsible vulnerability reporting, or maintaining exploit proof-of-concept code • Background in DevSecOps, CI/CD security gating, or SAST/DAST tooling • Prior technical content review, assessment design, or QA for security-focused engineering tasks

Mercor eligibility fields: Eligible work locations: United States.

AI evaluation Research

Compensation context

The listing states $70 - $90 / hour. Confirm the final rate, workload, and payment terms during the official application process.

• Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments

Not the right fit?

Use your CV to find relevant roles on HumanitApp. This is separate from a partner application.

Optional role alerts from HumanitApp. Subscribe only if you want weekly emails.

Can I start immediately through an Instant Work Offer?

This listing is not a promise of immediate work. Mercor may send separate offers to prequalified candidates. Read how Instant Work Offers work .

How should I compare the listed pay?

The listing states $70 - $90 / hour. Confirm the final rate, workload, and payment terms during the official application process.

Does Apply use a referral link?

Yes. The button opens the exact verified Mercorlisting using the referral URL published for this role.

Is HumanitApp the employer?

No. HumanitApp independently curates the opportunity. The partner platform manages applications and hiring decisions.

Must I share my details here?

No. Choose the primary Apply action to continue directly without giving HumanitApp your name or email address.