Senior Vulnerability Engineer

The role

This person will discover novel vulnerabilities in hardware and software systems. They will design research plans and build custom tooling to turn research into technical artifacts.

What you will do

• Find novel vulnerabilities in software, firmware, embedded systems, protocols, update paths, device interfaces, and hardware/software integration boundaries.
• Design and execute vulnerability research plans using code review, reverse engineering, fuzzing, emulation, dynamic instrumentation, hardware analysis, and adversarial testing.
• Build custom fuzzers, harnesses, emulators, instrumentation, triage workflows, and proof-of-concept tooling.
• Analyze root cause, exploitability, operational impact, and mitigation options for discovered vulnerabilities.
• Partner with engineering teams to validate findings and drive practical remediation.
• Write clear technical reports including evidence, reproduction steps, exploitability assessment, impact, and mitigations.
• Design hardware-in-the-loop vulnerability experiments.
• Develop tooling to automate experiment orchestration, device interaction, data collection, crash triage, and vulnerability reproduction.

Required qualifications

• Strong experience discovering vulnerabilities in firmware, applications, network services, embedded Linux systems, drivers, protocols, IoT devices, or hardware-adjacent systems.
• Proficiency with one or more programming languages such as Python, C, C++, Rust, or Go.
• Experience with fuzzing, harness development, crash triage, exploitability analysis, source-code review, binary analysis, or dynamic instrumentation.
• Ability to reason about memory corruption, logic flaws, authentication and authorization failures, unsafe parsing, concurrency issues, insecure update flows, and trust-boundary failures.
• Hands-on familiarity with Linux, embedded systems, networking, debugging, and common security research tooling.
• Ability to communicate vulnerability impact, reproduction steps, and mitigation options clearly.
• Demonstrated bias toward practical, mission-enabling security outcomes.
• Must be eligible to obtain and maintain a U.S. security clearance.
• Experience evaluating vulnerabilities across embedded protection mechanisms such as secure boot, firmware update paths, key storage, memory protection, and debug interface controls.
• Comfort working with lab-based vulnerability validation using hardware interfaces, protocol analyzers, debuggers, or instrumented test setups.

Nice to have

• Experience finding vulnerabilities in boot chains, firmware update mechanisms, device identity systems, cryptographic integrations, anti-tamper mechanisms, or programmable-logic-backed systems.
• Experience with advanced vulnerability research techniques such as coverage-guided fuzzing, symbolic execution, differential testing, fault injection, protocol state modeling, or hardware-in-the-loop
• Familiarity with reverse-engineering tools such as Ghidra, IDA Pro, Binary Ninja, QEMU, Frida, gdb/lldb, or comparable frameworks.
• Background in embedded, aerospace, robotic, RF, or cyber-physical systems.
• Track record of producing high-quality vulnerability research artifacts, internal tooling, conference-quality writeups, CVEs, or comparable technical outputs.
• Experience applying side-channel analysis, fault injection, black-box testing, or hardware-assisted fuzzing to embedded systems.
• Experience with RF protocols, cryptographic protocol analysis, FPGA/SoC security, signal processing, or board-level vulnerability assessment.
• Demonstrated technical leadership, mentorship, or ownership of complex vulnerability research efforts.

Benefits

• Comprehensive, competitive benefits package available at little to no cost to employees

Before you apply

• Must be eligible to obtain and maintain a U.S. security clearance.
• By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening.

About the company

Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. Their family of systems is powered by Lattice OS, an AI-powered operating system.