Senior Vulnerability Researcher — Firmware & Exploits (Remote)

Legion X; Arlington (VA); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Legion X is seeking a Vulnerability Researcher to turn discovered vulnerabilities into PoCs across firmware and software. You will analyze binaries on architectures like x86 and ARM, identify vulnerabilities, and document your findings for both technical and non-technical audiences.

You must be a firmware reverse engineer capable of turning analysis into practical exploits. Hybrid work with some Northern Virginia commute is preferred, remote work possible.

Qualifications

• Experience reversing firmware and software to identify vulnerabilities.
• Strong cyber vulnerability research capabilities with proven documentation.
• Proficient in protocol analysis and communicating complex findings.
• Ability to turn findings into PoCs for multiple devices and firmware types.
• Comfortable working in a small team with ownership of results.

Responsibilities

• Analyze binaries across architectures (e.g., x86, ARM, PowerPC).
• Identify, explain, and exploit vulnerabilities in reverse engineered code.
• Develop PoC demonstrations and document findings for non-technical audiences.
• Integrate work into government systems or commercial deployments.
• Collaborate with engineering leads and adapt to varied tasks in a small company.

Skills

Firmware reverse engineering

Cyber vulnerability research

Protocol analysis

Written and verbal communication

Self-motivation and drive

Interest in the work

C/C++ programming

Hands-on hardware experience

RF experience

Firmware programming experience

Ghidra/IDA Pro

Tools

Ghidra

IDA Pro

Job description

Legion X is seeking a Vulnerability Researcher to turn discovered vulnerabilities into PoCs across firmware and software. You will analyze binaries on architectures like x86 and ARM, identify vulnerabilities, and document your findings for both technical and non-technical audiences.

You must be a firmware reverse engineer capable of turning analysis into practical exploits. Hybrid work with some Northern Virginia commute is preferred, remote work possible.