Associate Vulnerability Researcher

We strive to offer a great work life balance – if you are looking for full time, part time or flexible options, we will try to make this work where business possible. This will be dependent on the kind of role you do and part of the business you work in.

About the Candidate

• An interest and aptitude for vulnerability research (either from a professional background or by demonstrating an aptitude).
• A passion for understanding how things work, testing them, pushing them to their limits, and finding security issues in them.
• An appreciation of hardware and software development lifecycles and their impact on security practices.
• Knowledge of cryptographic algorithms (encryption, authentication, signatures, etc).
• Knowledge of data structures, distributed systems, virtualisation and containerisation technologies.
• An understanding of network protocols and how software works – either assembly or interpreted languages, or anything in between.
• Familiarity with or a strong demonstrable interest in vulnerabilities such as memory corruption bugs (stack/heap/integer overflows, format strings), and an interest in techniques attackers can use to bypass common security protections (e.g. NX, stack canaries, heap protection, ASLR, etc.)
• Knowledge and experience of embedded systems and operating systems, and hardware techniques for prototyping and debugging these.
• An appreciation of Linux OS internals. Ability to self-learn any language, given appropriate resources to study and practice.
• Practical knowledge of common white-hat exploitation toolsets and techniques for common flaws in low-level software, as well as web platforms (e.g. SQL injection, XSS, CSRF, SSRF, upload/download abuse, RCE).
• Reverse engineering experience (e.g. IDA Pro, Ghidra).

JBRP1_UKTJ