Remote Senior Android Kernel Exploit Engineer

Trenchant; United States; Remote; USD 160,000 - 230,000; Full time

Job summary

Trenchant is seeking a senior exploit developer to ship Android/Linux kernel exploits in real-world environments. You will tackle zero-day and N-day vulnerabilities, leverage advanced memory-management and concurrency techniques, and craft robust, regression-tested exploit chains.

The role is fully remote with high autonomy, collaborating with vulnerability researchers and exploit developers to adapt across Android releases, SoCs and patch levels.

Qualifications

• A substantial record of delivering working Android or Linux kernel exploits — not only finding bugs or producing crashes.
• Expert knowledge of kernel memory management, object lifetimes, concurrency, locking, scheduling and common driver architectures.
• Advanced SLUB and kernel-heap exploitation experience, including modern cross-cache or page-level techniques.
• Strong ARM64 reverse engineering and debugging skills across source-available and partially proprietary components.
• Practical knowledge of Android GKI, vendor modules, Binder, SELinux and mobile driver attack surfaces.
• Deep familiarity with KASLR, PAN/PXN, CFI, PAC/BTI where relevant, hardened usercopy, refcount hardening and memory-tagging constraints.
• The discipline to turn probabilistic exploitation into maintainable, testable delivery.

Responsibilities

• Develop and ship working Android/Linux kernel exploits for vendor kernels.
• Model allocators and concurrency, defeat mitigations, deliver robust exploits.
• Create reusable primitives for info disclosure, read/write, and cred manipulation.
• Produce target-aware exploit packages with diagnostics and cleanup.
• Provide explicit reliability data and known failure modes.
• Collaborate remotely with vulnerability researchers and exploit developers.

Skills

Kernel exploit development

ARM64 reverse engineering

Kernel memory management

Concurrency and locking

Driver architectures (Linux/Android)

Debugging and tracing

Exploit development tooling

Tools

Binder

SELinux

KASLR

Ghidra

IDA Pro

Job description

Trenchant is seeking a senior exploit developer to ship Android/Linux kernel exploits in real-world environments. You will tackle zero-day and N-day vulnerabilities, leverage advanced memory-management and concurrency techniques, and craft robust, regression-tested exploit chains.

The role is fully remote with high autonomy, collaborating with vulnerability researchers and exploit developers to adapt across Android releases, SoCs and patch levels.