Offensive Vulnerability Researcher – Onsite Cyber Defender

VetJobs; Washington (District of Columbia); On-site; USD 110,000 - 135,000; Full time

Job summary

JPMorgan Chase in Washington, DC seeks an X-Day Offensive Research (XOR) Vulnerability Researcher—Assessments & Exercises to advance the firm’s cybersecurity posture through risk-driven assessments, reverse engineering, and exploit development.

Responsibilities include designing simulations, evaluating controls, and producing detailed reports with remediation recommendations for IOCs and risk management. Collaboration with defense teams and cross-functional groups is required.

Qualifications

• 5+ years of experience in cybersecurity or resiliency with offensive testing focus.
• Track record of discovered vulnerabilities (CVEs) in at least one of OS, mobile, web, browsers, edge devices, or enterprise software.
• Proven hands-on vulnerability research and exploit development experience.

Responsibilities

• Design and execute testing and simulations including penetration tests, controls assessments, and cyber exercises.
• Evaluate controls for effectiveness and impact on operational risk, including automation opportunities.
• Conduct vulnerability research and exploit development across OS, mobile, web apps, browsers, edge devices, and enterprise software.
• Reverse engineer binaries to identify attack surfaces and develop PoCs.
• Use fuzzers, disassemblers, debuggers, and code browsers for static/dynamic analysis.
• Document findings, risk assessments, and remediation recommendations for vulnerability triage and patch prioritization.

Skills

Reverse engineering

Vulnerability research

Exploit development

Security testing

Offensive security

Team collaboration

Education

High School/GED

Bachelor's degree

Tools

IDA Pro

Ghidra

Binary Ninja

WinDbg

GDB

RR

Job description

JPMorgan Chase in Washington, DC seeks an X-Day Offensive Research (XOR) Vulnerability Researcher—Assessments & Exercises to advance the firm’s cybersecurity posture through risk-driven assessments, reverse engineering, and exploit development.

Responsibilities include designing simulations, evaluating controls, and producing detailed reports with remediation recommendations for IOCs and risk management. Collaboration with defense teams and cross-functional groups is required.