Senior 5G & Protocol Security Vulnerability Researcher

CACI International Inc.; Florham Park (NJ); On-site; USD 113,000 - 238,000; Full time

Job summary

CACI International Inc. in Florham Park, NJ, is seeking a Senior Vulnerability Researcher specializing in 5G and protocol security to reverse-engineer closed telecom systems and uncover critical flaws.

You will build stateful fuzzers, analyze 3GPP signaling, and develop PoCs for AMF/SMF/UPF, while documenting findings for security and engineering teams. The role requires 7+ years in vulnerability research, 5G knowledge, and hands-on experience with IDA Pro, Ghidra, and Python automation; US

Qualifications

• 7+ years of vulnerability research, protocol analysis, or reverse engineering.
• Deep understanding of 5G/4G architecture and 3GPP security standards.
• Experience with Linux kernel internals or RTOS used in telecom hardware.
• Hands-on with disassembly and decompilation tools (IDA Pro, Ghidra, Binary Ninja).
• US citizen and able to obtain/maintain a security clearance.
• Active TS/SCI clearance highly desired.

Responsibilities

• Investigate edge-case behaviors and low-level protocol signaling to reveal attack surfaces in proprietary telecom and embedded systems.
• Apply advanced binary analysis to reverse-engineer proprietary 5G baseband firmware and Network Function (NF) binaries where source code is unavailable.
• Develop custom tools and scripts in Python3 to automate protocol decoding, firmware unpacking, and analysis workflows.
• Develop and deploy custom stateful fuzzers for 3GPP protocols (e.g., NGAP, HTTP/2, PFCP, GTP-U) to identify crashes and stability issues in the 5G Core.
• Utilize concolic and symbolic execution (e.g., Angr, Manticore) to map complex state machines and uncover logic flaws in 5G session management and authentication flows.
• Create reliable Proof-of-Concept (PoC) exploits for discovered vulnerabilities in critical components such as AMF, SMF, or UPF.
• Document findings clearly and translate technical protocol complexity into actionable reports for security and engineering teams.

Skills

Vulnerability research

Protocol analysis

Reverse engineering

5G security

C/C++

Python

Education

Bachelor's degree or higher

Tools

IDA Pro

Ghidra

Binary Ninja

JTAG/UART debugging

Job description

CACI International Inc. in Florham Park, NJ, is seeking a Senior Vulnerability Researcher specializing in 5G and protocol security to reverse-engineer closed telecom systems and uncover critical flaws.

You will build stateful fuzzers, analyze 3GPP signaling, and develop PoCs for AMF/SMF/UPF, while documenting findings for security and engineering teams. The role requires 7+ years in vulnerability research, 5G knowledge, and hands-on experience with IDA Pro, Ghidra, and Python automation; US