Sr. Exploit Developer (US)

VulnCheck Inc.; United States; Remote; USD 180,000 - 260,000; Full time

Benefits offered by this job

Unlimited PTO

Parental leave

Healthcare coverage

401(k) match

Job summary

vulncheck is seeking a senior exploit developer for the Initial Access Intelligence team. The role focuses on reverse engineering and crafting original exploit code where public PoC is missing, spanning from root-cause analysis to detection engineering.

This fully remote position is within the United States, with priority for candidates in Massachusetts, Maryland, or Austin, Texas. You will contribute to an open-source exploit framework and develop ASM queries and detection rules to surface

Qualifications

• Experience writing exploit code for remote-code-execution and initial access vulnerabilities without authentication.
• Strong reverse engineering skills with a track record of producing working exploit code.
• Experience working on technical projects remotely, independently, and in small teams.
• Ability to share example exploit code as part of the application process.

Responsibilities

• Reverse engineer software to identify the root cause of vulnerabilities.
• Author original exploits for initial access vulnerabilities when little or no public PoC exists.
• Implement network and host detections (Suricata/Snort, YARA) to identify exploitation on the wire.
• Write Attack Surface Management queries using Shodan, Censys, FOFA, and ZoomEye to surface vulnerable systems.
• Contribute to local and other exploit types, and to an open-source exploit framework.

Skills

Exploit development experience

Reverse engineering

Remote work experience

Code sharing during application

Job description

Role overview

A senior exploit developer role on an Initial Access Intelligence team, focused on reverse engineering and crafting original exploit code where public proof-of-concept material is missing. Work spans from root-cause analysis through detection engineering and attack surface queries, with opportunities to contribute to an open-source exploit framework. It is a fully remote position, with priority given to candidates based in Massachusetts, Maryland, or Austin, Texas.

Responsibilities

• Reverse engineer software to identify the root cause of vulnerabilities.
• Author original exploits for initial access vulnerabilities, particularly when little or no public proof-of-concept code exists.
• Implement network and host detections, such as Suricata/Snort signatures and YARA rules, to identify exploitation on the wire.
• Write Attack Surface Management queries using platforms like Shodan, Censys, FOFA, and ZoomEye to surface vulnerable systems likely to be targeted.
• Contribute occasionally to local and other exploit types, and to an open-source exploit framework.

Requirements

• Prior experience writing exploit code for remote-code-execution or other initial access vulnerabilities that do not require authentication to exploit.
• Demonstrated reverse engineering skills and a track record of producing working exploit code.
• Experience working on technical projects remotely, independently, and as part of small teams.
• Ability to share example exploit code as part of the application process.

Nice to have

• Prior cybersecurity work experience at a vendor or in government.
• Familiarity with crafting network and host-based detection rules and ASM queries for finding exposed systems.
• Experience contributing to open-source security tooling or exploit frameworks.

Benefits and work setup

• Fully remote within the United States.
• Unlimited paid time off, generous paid parental leave, and comprehensive healthcare coverage.
• 401(k) plan with company match and reimbursement for cell phone and internet expenses.
• Ongoing professional development and clear career-advancement opportunities within a growing research organization.
• Note: employment is contingent on the ability to authorize access under applicable U.S. export control regulations.