Windows Driver Exploitation Engineer APPLIED AI VR WINDOWS New York, NY / On Site →

Zealot Labs, Inc.; New York, Northern (NY, KY); Hybrid; USD 100,000 - 195,000; Full time

Benefits offered by this job

Equity

Job summary

Zealot Labs, Inc. in New York seeks a Windows kernel vulnerability researcher to uncover critical driver and kernel weaknesses. You will develop exploit primitives, analyze Windows drivers, and build automated tooling for vulnerability triage.

Experience in kernel internals, reverse engineering, and C/C++ is essential. The role is on-site in New York, with substantial ownership and equity since the company is early-stage and backs by top investors.

Qualifications

• Experience in Windows kernel vulnerability research and exploit development.
• Strong C/C++ skills for kernel-level development and exploitation.
• Proficiency with disassembly tools and static/dynamic analysis.
• Familiarity with Windows driver internals and driver analysis frameworks.

Responsibilities

• Discover and exploit vulnerabilities in Windows kernel-mode and user-mode drivers.
• Research attack surfaces across Windows drivers and kernel subsystems.
• Develop exploit primitives for privilege escalation, sandbox escape, and kernel code execution.
• Build automated tooling for Windows driver analysis, fuzzing, and vulnerability triage.
• Deep experience with Windows kernel internals: I/O manager, object manager, memory manager.
• Proven track record of driver vulnerability research (CVEs, ZDI submissions, or offensive work).
• Strong x86/x64 reverse engineering and exploit development skills.
• Proficiency with WinDbg, IDA/Ghidra, and driver analysis frameworks.
• Strong C/C++ skills for kernel-level development and exploitation.

Skills

Windows kernel

Kernel exploitation

C/C++

Reverse engineering

WinDbg

IDA/Ghidra

Tools

WinDbg

IDA

Ghidra

Job description

Zealot is deploying AI systems at the center of western cyber operations , backed by tier-1 US VCs and industry leaders. Our team includes alumni of Anthropic, xAI, and Anduril. Soon live with close U.S. allies abroad.

APPLIED AI VR WINDOWS

Compensation 100K-195K + skin in the game equity

Location New York, NY On Site

Stage Early-stage startup backed by tier 1 investors. Small, growing team with exceptionally high ownership.

• + Discover and exploit vulnerabilities in Windows kernel-mode and user-mode drivers.
• + Research attack surfaces across WDDM display drivers, network miniport drivers, filesystem filter drivers, and third-party kernel extensions.
• + Develop exploit primitives for privilege escalation, sandbox escape, and kernel code execution.
• + Build automated tooling for Windows driver analysis, fuzzing, and vulnerability triage.
• + Deep experience with Windows kernel internals: I/O manager, object manager, memory manager.
• + Proven track record of driver vulnerability research (CVEs, ZDI submissions, or offensive work).
• + Strong x86/x64 reverse engineering and exploit development skills.
• + Proficiency with WinDbg, IDA/Ghidra, and driver analysis frameworks.
• + Strong C/C++ skills for kernel-level development and exploitation.

Nice to Have

• + Experience with Hyper-V and virtualization-based security (VBS) attack surfaces.
• + Familiarity with Windows driver fuzzing (kAFL, what the fuzz, custom harnesses).
• + Experience with BYOVD (Bring Your Own Vulnerable Driver) attack techniques.
• + Knowledge of Windows Defender / EDR kernel-mode components.
• + Experience building with LLMs and AI agents.
• + Published research or conference talks on Windows kernel security.
• + Deeply technical and motivated to find the bugs that matter at the kernel level.
• + Clearly interested in stepping away from purely manual research and moving toward the development of AI systems.
• + Building something massive matters more to you than comfort, titles, or predictability.
• + You want to be early at a company that will change an industry, and you're ready to do what that actually takes.

Note to recruiting firms: Windows driver vulnerability research is the core requirement. Kernel exploitation experience is essential. Familiarity with modern Windows security mitigations is a strong plus.

Ready?