Vulnerability Researcher (AI Prompt Analysis)

About the role

SD Solutions, a global staffing company, is recruiting on behalf of a SafetyTech client for a Vulnerability Researcher in its security research division. The role focuses on analysing cybersecurity prompts submitted to an AI system that cannot confidently classify them as benign or malicious, with a focus on vulnerability research, exploit development and reverse engineering. It is a full-time remote position.

Key responsibilities

• Review cybersecurity prompts that the AI system could not confidently classify as benign or malicious.
• Determine the underlying intent and goal of each prompt and assess whether the user is pursuing a legitimate purpose or an intent to cause harm.
• Use deep domain expertise to judge the technical context, specificity and potential real-world impact of a response for an attacker.
• Annotate each prompt with an intent label and a clear written rationale, following project guidelines.
• Annotate the same prompts independently as a second researcher; disagreements are escalated to a reviewer.
• Flag ambiguous cases, emerging attack techniques and gaps in the guidelines, and help improve them.

Required profile

• Minimum of 5 years of proven, hands-on experience in vulnerability research and reverse engineering.
• Ability to discover vulnerabilities through fuzzing, static and dynamic analysis and patch diffing.
• Exploit development experience, including memory corruption, heap exploitation, ROP and mitigation bypasses (ASLR, DEP, CFI).
• Fluent use of IDA, Ghidra, Binary Ninja and debuggers (WinDbg, GDB, LLDB) on x86/x64 and ARM binaries.
• Understanding of the CVE lifecycle, n-day versus 0-day work and how public PoCs are weaponized.
• Strong analytical judgment to infer a user's goal from a short prompt and separate defensive, educational and research use from attack preparation.
• Clear written communication in English, able to document reasoning concisely.
• Nice to have: OSED, OSEE, GIAC GXP certification, and demonstrated achievements, write-ups or contributions on HackTheBox, Pwn2Own, TryHackMe, bug bounty programs or published security research.