CVE Vulnerability Expert

HumanitApp; United States; On-site; USD 96,000 - 124,000; Full time

Job summary

HumanitApp is seeking an experienced security evaluation researcher to assess vulnerability reproductions, remediation quality, and verification logic in AI-lab environments. You will review CVE fidelity, fixes, and docker-based labs to ensure exploitable conditions are accurately represented.

The role requires hands-on security experience, knowledge of CVE taxonomy, and ability to deliver rubric-based feedback.

Qualifications

• 3+ years in application security, pentesting or vulnerability research.
• Strong understanding of CVE taxonomy and severity frameworks (CVSS, CWE, CAPEC).
• Secure coding and remediation across common vulnerability classes (SQLi, RCE, buffer overflows, deserialization, SSRF).
• Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests).
• Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments.

Responsibilities

• Evaluate CVE reproductions for fidelity, fixes, and verification rigor.
• Assess Docker-based labs reproducing exploitable conditions.
• Provide rubric-based written feedback on vulnerability reproduction and remediation tasks.

Skills

Application security

Penetration testing

Vulnerability research

CVE taxonomy and CVSS

Verification logic design

2-part verification strategy

Tools

Docker

Docker Compose

Job description

Evaluate the quality, fidelity, and completeness of vulnerability-reproduction and remediation tasks used to train and evaluate a frontier AI lab's models. You'll assess whether CVE reproductions are faithful, fixes are sound, verification logic is rigorous, and Docker-based lab environments accurately recreate exploitable conditions

and provide clear, rubric-based written feedback.

Basic Qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
• Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC)
• Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, privilege escalation)
• Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests)
• Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments

Preferred Qualifications

• OSCP, GPEN, GWAPT, or equivalent offensive-security certification
• Experience with CVE disclosure, responsible vulnerability reporting, or maintaining exploit proof-of-concept code
• Background in DevSecOps, CI/CD security gating, or SAST/DAST tooling
• Prior technical content review, assessment design, or QA for security-focused engineering tasks

AI evaluation Research

Who this role may fit

This opportunity may suit professionals with relevant experience in AI evaluation, Research. Review the official description and requirements before applying.

Compensation context

The listing states $70 - $90 / hour. Confirm the final rate, workload, and payment terms during the official application process.

• You can show recent, specific work involving AI evaluation, Research.
• The listed commitment of 40 hours/week fits your schedule.
• You can communicate your reasoning clearly in the application language.
• You are comfortable with project availability and hours varying over time.