[Hiring] CVE Vulnerability Researcher @24-MAG

Role Description

We are sharing a specialised part-time consulting opportunity for experienced vulnerability researchers and application security professionals with strong expertise in CVE analysis, vulnerability reproduction, secure remediation, and security testing. This role focuses on evaluating vulnerability-reproduction and remediation tasks for technical accuracy, realism, completeness, and verification quality. Selected experts will review CVE-based scenarios, proposed fixes, security test logic, and containerised lab environments while providing clear, rubric-based technical feedback.

Key Responsibilities

• CVE & Vulnerability Review
  • Evaluate vulnerability-reproduction tasks based on documented CVEs
  • Assess whether scenarios faithfully represent the underlying vulnerability
  • Review technical assumptions, affected components, and expected behaviour
  • Identify incomplete, inaccurate, or unrealistic reproductions
  • Apply practical judgement grounded in hands-on vulnerability research or application security experience
• Vulnerability Classification
  • Review security issues using established vulnerability taxonomies
  • Apply frameworks such as CVE, CVSS, CWE, and CAPEC
  • Assess vulnerability classification and severity rationale
  • Identify incorrect or misleading categorisation
  • Evaluate whether reported security impact is supported by the technical evidence
• Application Security & Remediation
  • Review proposed fixes for common application and system vulnerabilities
  • Assess remediation approaches involving issues such as:
    • SQL injection
    • Command injection
    • Buffer overflow
    • Insecure deserialisation
    • SSRF
    • Misconfigurations
    • Privilege escalation
  • Determine whether fixes address the underlying security issue rather than only its symptoms
  • Identify regressions or functionality problems introduced by remediation
  • Evaluate secure coding approaches for technical soundness
• Verification & Security Testing
  • Review verification logic used to confirm vulnerability remediation
  • Evaluate paired functionality tests and vulnerability-focused tests
  • Assess whether tests demonstrate both preserved application behaviour and removal of the security weakness
  • Identify incomplete coverage or misleading validation
  • Determine whether verification criteria are sufficiently rigorous and reproducible
• Docker-Based Security Labs
  • Review vulnerability reproduction environments built with Docker and Docker Compose
  • Assess whether multi-container environments accurately reproduce required conditions
  • Evaluate configuration, dependencies, networking, and service interactions
  • Identify environmental issues that could affect reproducibility
  • Review whether lab environments support consistent security evaluation
• Technical Reproduction & QA
  • Assess whether security scenarios can be reproduced reliably
  • Review setup instructions, dependencies, configurations, and expected outcomes
  • Identify missing assumptions or inconsistencies affecting repeatability
  • Evaluate whether task scope is appropriate and technically complete
  • Distinguish environment defects from genuine security findings
• Secure Development Review
  • Evaluate application changes from a secure-coding perspective
  • Identify incomplete or fragile remediation strategies
  • Review whether security fixes maintain intended application functionality
  • Assess code and configuration changes for security implications
  • Apply practical application-security judgement across different vulnerability classes
• Security Tooling & Engineering Workflows
  • Review workflows involving secure development and vulnerability assessment
  • Apply familiarity with SAST, DAST, CI/CD security controls, and DevSecOps practices where relevant
  • Assess whether security checks are appropriately integrated into development processes
  • Identify gaps in validation or security gating
  • Evaluate security engineering recommendations for practical effectiveness
• Rubric-Based Technical Evaluation
  • Assess assigned security tasks against structured technical criteria
  • Provide clear written explanations supporting evaluation decisions
  • Reference specific reproduction, remediation, testing, or configuration evidence
  • Apply evaluation standards consistently across assignments
  • Distinguish valid alternative security approaches from technically flawed solutions

Qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
• Strong understanding of CVE vulnerability taxonomy and severity frameworks
• Practical knowledge of CVSS, CWE, and CAPEC
• Strong secure-coding and remediation experience across common vulnerability classes
• Experience reviewing or designing security verification logic
• Proficiency with Docker and Docker Compose
• Strong ability to evaluate whether vulnerability reproductions and remediation approaches are technically sound
• Experience with responsible vulnerability disclosure or CVE reporting is advantageous
• Experience maintaining security proof-of-concept code is advantageous
• Background in DevSecOps, CI/CD security gating, SAST, or DAST tooling is preferred
• Certifications such as OSCP, GPEN, GWAPT, or equivalent are advantageous
• Previous technical review, security assessment design, or QA experience is preferred
• Strong written communication and ability to provide precise technical feedback

Engagement Details

• Part-time independent contractor engagement
• Fully remote within the United States
• Flexible scheduling based on project requirements
• Compensation: $60–$80/hour
• Work focuses on CVE analysis, vulnerability reproduction, secure remediation, verification logic, and security task evaluation
• Projects may be extended, shortened, or concluded based on project needs and performance
• Work must be completed without using confidential or proprietary information belonging to any employer, client, institution, or other third party
• H1-B and STEM OPT support is unavailable for this engagement