Vulnerability Researcher

EvalLabs; San Francisco (CA); Remote; USD 91,000 - 129,000; Part time

Job summary

EvalLabs is hiring experienced vulnerability researchers for remote contract work on your schedule. You will work on real-world security scenarios, including attack paths, exploitation, detection, and analysis, and review technical security content for accuracy. This is project-based work that helps train and evaluate AI models on security; no AI experience needed.

We offer up to $80/hr, fully remote and async with no meetings, and 5-20 hours a week, so it fits alongside a full-time job.

Qualifications

• 3+ years of professional experience in vulnerability research, exploit development, or offensive security.
• Hands-on experience with tools like IDA Pro, Ghidra, GDB/WinDbg, AFL/libFuzzer, Burp Suite, or pwntools.
• Nice to have: OSCP, OSEP, OSWE, CPTS, GPEN, GXPN, or similar.

Responsibilities

• Work on real-world security scenarios: attack paths, exploitation, detection, and analysis.
• Review technical security content for accuracy and catch what's wrong or missing.
• Write expert-level examples based on how the work is actually done.

Skills

Vulnerability research

Exploit development

Offensive security

Security analysis

Education

OSCP cert

OSEP cert

OSWE cert

GPEN cert

Tools

IDA Pro

Ghidra

GDB/WinDbg

AFL/libFuzzer

Burp Suite

pwntools

Job description

If you find bugs, write exploits, or triage CVEs, this is flexible paid work built around that expertise. EvalLabs is hiring experienced vulnerability researchers for remote contract work on your schedule.

What you'll do

• Work on real-world security scenarios: attack paths, exploitation, detection, and analysis
• Review technical security content for accuracy and catch what's wrong or missing
• Write expert-level examples based on how the work is actually done in the field

This is project-based work that helps train and evaluate AI models on security. No AI experience needed. We want your security judgment.

The deal

• Up to $80/hr, paid per hour worked
• Fully remote and async, with no meetings or set schedule
• 5-20 hrs a week, no minimum, so it fits next to a full-time job

You have

• 3+ years of professional experience in vulnerability research, exploit development, or offensive security
• Hands‑on experience with tools like IDA Pro, Ghidra, GDB/WinDbg, AFL/libFuzzer, Burp Suite, or pwntools
• Nice to have: OSCP, OSEP, OSWE, CPTS, GPEN, GXPN, or similar