Vulnerability Research and Exploit Developer

CACI International; Fort Meade (MD); On-site; USD 94,000 - 198,000; Full time

Job summary

CACI International is seeking a Vulnerability Research and Exploit Developer to support DoD and IA/IC requirements, analyzing and exploiting mobile and network devices. You will identify security weaknesses, develop tools, and apply AI-assisted workflows to accelerate discovery, collaborating with JCOG to ensure non-disruptive mission execution.

The role requires TS/SCI with polygraph, a bachelor’s in CS/engineering with 5+ years’ experience, and strong C/C++, Python, and reverse engineering

Qualifications

• Bachelor’s degree or higher in a related field with strong performance in software security and exploit development.
• Proven track record identifying and exploiting security weaknesses on mobile and network devices.
• Experience with exploit development, reverse engineering, and vulnerability assessment tools.

Responsibilities

• Conduct in-depth vulnerability research and exploit development for mobile and network devices.
• Identify and analyze security weaknesses in complex systems, providing actionable insights and solutions.
• Collaborate with interagency partners and JCOG to support mission objectives.
• Develop and maintain tools/scripts for automated vulnerability detection and exploitation.
• Maintain detailed documentation of research findings and exploit development processes.

Skills

C/C++

Python

assembly (ARM/x86)

exploit development

reverse engineering

Ghidra

IDA Pro

Frida

GDB/LLDB

Java/Kotlin (Android)

Education

Bachelor’s degree in CS/Cybersecurity/Engineering

Master’s degree (desirable)

Tools

IDA Pro

Ghidra

Binary Ninja

Frida

QEMU

GDB/LLDB

Job description

Job Title: Vulnerability Research and Exploit Developer

Job Category: Engineering

Time Type: Full time

Minimum Clearance Required to Start: TS/SCI with Polygraph

Employee Type: Regular

Percentage of Travel Required: Up to 10%

Type of Travel: Local

The Opportunity:

As a Vulnerability Research and Exploit Developer (VRED) at CACI, you will play a crucial role supporting DoD and IA/IC requirements analyzing and exploiting mobile and network devices. You will be responsible for identifying and exploiting security weaknesses in complex systems while working closely with interagency partners within an interagency facility. Your role will involve seamless integration with Joint Cyber Operations Group (JCOG) personnel to ensure non-disruptive mission execution. This position demands strong analytical and problem-solving skills, excellent written and verbal communication skills, and the ability to thrive in a fast-paced, dynamic environment. The successful candidate will attain and maintain a Polygraph and Top Secret/SCI (TS/SCI) security clearance.

• Conduct in-depth vulnerability research and exploit development for mobile and network devices.
• Identify and analyze security weaknesses in complex systems, providing actionable insights and solutions.
• Experience applying artificial intelligence models and AI-assisted workflows to accelerate vulnerability discovery and exploit development (e.g., LLM-assisted code analysis, reverse engineering, and triage).
• Collaborate effectively with interagency partners and JCOG personnel to support mission objectives.
• Develop and maintain tools and scripts for automated vulnerability detection and exploitation.
• Ensure seamless integration of developed solutions into existing systems without disrupting ongoing operations.
• Provide technical guidance and support to team members, fostering a collaborative work environment.
• Maintain detailed documentation of research findings, exploit development processes, and solution implementations.
• Stay current with cybersecurity/VR/exploit development.

Qualifications:

Required:

• Current Top Secret/SCI (TS/SCI) security clearance with polygraph.
• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related field, with a minimum of five years of relevant experience; or equivalent combination of education and experience.
• Proven track record of identifying and exploiting security weaknesses in mobile and network devices.
• Strong proficiency in programming languages such as C/C++, Python, and assembly (ARM/x86).
• Experience with exploit development techniques, reverse engineering, and vulnerability assessment tools and frameworks (e.g., IDA Pro, Ghidra, Binary Ninja, Frida, GDB/LLDB, QEMU).
• Excellent written and verbal communication skills.
• Ability to work independently with minimal oversight and function effectively within a team.

Desired:

• Master’s degree in a related field.
• Certifications such as OSCP (Offensive Security Certified Professional), OSED/OSEE (Offensive Security exploit development certifications), GXPN (GIAC Exploit Researcher and Advanced Penetration Tester), and GREM (GIAC Reverse Engineering Malware).
• Experience building fuzzing harnesses (e.g., AFL++, libFuzzer, honggfuzz) and triaging the resulting crashes to root cause.
• Deep understanding of memory-corruption vulnerability classes (stack/heap overflow, use-after-free, type confusion) and techniques for bypassing modern exploit mitigations (ASLR, DEP/NX, stack canaries, CFI/CFG, PAC, application sandboxing).
• Proficiency in reverse engineering closed-source binaries and embedded firmware (static and dynamic analysis).
• Hands-on experience with iOS and/or Android internals—sandbox escape, kernel exploitation, baseband, and TrustZone/Secure Enclave—beyond general familiarity.
• Demonstrated research output—published CVEs, Pwn2Own results, DEFCON/Black Hat talks, or competitive CTF placements.
• Experience with kernel-mode/low-level exploitation and OS internals (e.g., XNU, Linux, Windows), including drivers.
• Java/Kotlin for Android-focused vulnerability research; familiarity with Rust or similar memory-safe systems languages is a pl

This position is contingent on funding and may not be filled immediately. However, this position is representative of positions within CACI that are consistently available. Individuals who apply may also be considered for other positions at CACI.

What You Can Expect:

A culture of integrity.

At CACI, we place character and innovation at the center of everything we do. As a valued team member, you’ll be part of a high-performing group dedicated to our customer’s missions and driven by a higher purpose – to ensure the safety of our nation.

An environment of trust.

CACI values the unique contributions that every employee brings to our company and our customers - every day. You’ll have the autonomy to take the time you need through a unique flexible time off benefit and have access to robust learning resources to make your ambitions a reality.

A focus on continuous growth.

Together, we will advance our nation’s most critical missions, build on our lengthy track record of business success, and find opportunities to break new ground — in your career and in our legacy.

Pay Range :

There are a host of factors that can influence final salary including, but not limited to, geographic location, Federal Government contract labor categories and contract wage rates, relevant prior work experience, specific skills and competencies, education, and certifications. Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives. We offer competitive compensation, benefits and learning and development opportunities. Our broad and competitive mix of benefits options is designed to support and protect employees and their families. At CACI, you will receive comprehensive benefits such as; healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.

$94,400 - $198,200

CACI is anEqualOpportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, age, national origin, disability, status as a protected veteran, or any otherprotectedcharacteristic.