Application Security Engineer – CVE & Vulnerability Research

The role

This person will review CVE vulnerability reproductions, exploit proof-of-concepts, and remediation approaches. They will work on application security testing, Docker-based labs, and exploit verification.

What you will do

• Reviewing CVE reproduction environments for technical accuracy
• Determining whether vulnerabilities faithfully reproduce the original attack vector and impact
• Evaluating proposed security fixes and remediation strategies
• Reviewing test suites to verify normal functionality and exploit mitigation
• Identifying incomplete fixes and alternative exploitation paths
• Reviewing Docker environments for correct software versions, services, networking, and configuration
• Detecting potential regressions or new vulnerabilities introduced by a fix
• Providing recommendations for improving vulnerability reproductions, fixes, and verification logic

Required qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
• Strong understanding of CVE, CVSS, CWE, and common vulnerability classes
• Experience identifying and remediating vulnerabilities such as SQL injection, Command injection, SSRF, Deserialization vulnerabilities, Buffer overflows, Privilege escalation, Access control issues, a
• Strong understanding of secure coding and vulnerability remediation
• Experience reviewing or developing exploit proof-of-concepts
• Experience validating whether security fixes address the root cause rather than only the immediate exploit
• Proficiency with Docker and Docker Compose
• Ability to provide clear, technically rigorous written feedback

Nice to have

• OSCP, GPEN, GWAPT, or equivalent security certification
• Experience with responsible vulnerability disclosure or CVE reporting
• Experience maintaining exploit proof-of-concept code
• Experience writing automated security tests using tools such as Python, requests, curl, pwntools, or Custom exploit harnesses
• DevSecOps experience
• Familiarity with SAST, DAST, and CI/CD security tooling
• Experience developing or reviewing cybersecurity assessments or technical security challenges
• Experience with AI evaluation, RLHF, or technical data projects

About the company

Anyone AI is recruiting experienced Application Security Engineers and Vulnerability Researchers for a specialized project.