Senior Vulnerability Researcher

Senior Vulnerability Researcher — Mobile (iOS / Android)

The work

You’ll spend your days where few researchers get to operate: deep inside modern mobile operating systems, finding what others assume is unbreakable. Reverse engineering, vulnerability research and full exploit development on iOS and Android — kernel, userland, baseband, firmware. Real research, on real targets, with the time and freedom to go as deep as the problem demands.

This is not pentesting, not red teaming, not a dashboard. It’s the hard version of the craft: understanding a system better than the people who built it, and turning that understanding into working capability.

What you’ll do

• Research and exploit vulnerabilities across modern mobile OS internals (iOS and/or Android).
• Reverse engineer complex, hardened systems — drivers, services, secure components.
• Develop exploits and proof-of-concepts, from single primitives to full chains.
• Build the tooling that pushes the whole team’s research further.

What we look for

• A serious offensive background — you’ve done real vulnerability research, not just assessed other people’s security.
• Hands-on mobile exploitation on iOS or Android (one is enough, both is a bonus).
• Found real vulnerabilities (0-day or 1-day), and know what it takes to weaponize them.
• Strong low-level reverse engineering (IDA / Ghidra), exploit development, ARM/aarch64 assembly, deep OS internals.
• The temperament the work demands: resilient, comfortable starting from zero, able to spend weeks on something that might not pan out — and come back the next day.

Nice to have

CVEs, published research, talks at OffensiveCon / Hexacon / POC, PWN2OWN, top-tier CTF. We care about what you can do, not how loud you are about it — strong researchers with zero public footprint are very welcome.

Why this one is different

• A small, elite team where everyone is genuinely world-class — you’ll learn every week.
• Research you can’t do anywhere else, with the depth and patience this craft actually needs.
• Compensation open to the market — base + bonus + bug bounty — set for the person, not the grid.
• Full relocation and visa support. We move the right people, wherever they are.
• Work that matters, for clients who depend on it.