CVE Vulnerability Researcher

🔥 22 hours ago

🗽 New York – Remote

🗽 New York – Remote

💵 $60 - $80 / hour

⏱ Part Time

🟡 Mid-level

🟠 Senior

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

24-MAG

WebsiteLinkedInAll Job Openings

2 - 10 employees

🤝 B2B

💼 Consulting

B2B • Consulting

24-MAG is a commercial strategy and execution firm that helps B2B organizations design and implement systems, workflows, and operating rhythms for sales, client management, and cross-functional projects. They focus on transforming scattered processes into aligned, measurable, and scalable commercial functions—covering pipeline structure, account management frameworks, and operational discipline for teams seeking efficient, intentional growth.

📋 Description

• Evaluate vulnerability-reproduction tasks based on documented CVEs • Assess whether scenarios faithfully represent underlying vulnerabilities • Review technical assumptions, affected components, expected behaviour, and reproduction completeness • Review security issues using CVE, CVSS, CWE, and CAPEC taxonomies and assess severity rationale • Review proposed fixes for application and system vulnerabilities, including SQL injection, command injection, buffer overflow, insecure deserialisation, SSRF, misconfigurations, and privilege escalation • Determine whether remediations address underlying security issues and identify regressions or functionality problems • Review verification logic, paired functionality tests, and vulnerability-focused security tests • Assess Docker and Docker Compose vulnerability-reproduction environments, including configuration, dependencies, networking, and service interactions • Assess technical reproducibility, setup instructions, dependencies, configurations, expected outcomes, scope, and completeness • Review application changes from a secure-coding perspective • Evaluate workflows involving SAST, DAST, CI/CD security controls, and DevSecOps practices • Assess assigned security tasks against structured technical criteria and provide clear rubric-based written feedback • Distinguish valid alternative security approaches from technically flawed solutions

🎯 Requirements

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research • Strong understanding of CVE vulnerability taxonomy and severity frameworks • Practical knowledge of CVSS, CWE, and CAPEC • Strong secure-coding and remediation experience across common vulnerability classes • Experience reviewing or designing security verification logic • Proficiency with Docker and Docker Compose • Strong ability to evaluate whether vulnerability reproductions and remediation approaches are technically sound • Experience with responsible vulnerability disclosure or CVE reporting is advantageous • Experience maintaining security proof-of-concept code is advantageous • Background in DevSecOps, CI/CD security gating, SAST, or DAST tooling is preferred • Certifications such as OSCP, GPEN, GWAPT, or equivalent are advantageous • Previous technical review, security assessment design, or QA experience is preferred • Strong written communication and ability to provide precise technical feedback • Work must be completed without using confidential or proprietary information belonging to any employer, client, institution, or other third party • H1-B and STEM OPT support is unavailable for this engagement

🏖️ Benefits

• Part-time independent contractor engagement • Fully remote within the United States • Flexible scheduling based on project requirements • Projects may be extended, shortened, or concluded based on project needs and performance • H1-B and STEM OPT support is unavailable for this engagement