vulnerability researcher

<div><p><b>Title:</b></p>
Vulnerability Researcher<p></p><p><b>
Why Join Us?</b></p><ul><li><b>
Innovative Projects:</b> KBR&rsquo;s work is at the forefront of engineering, logistics, operations, science, program management, mission IT and cybersecurity solutions.</li></ul><ul><li><b>
Collaborative Environment:</b> Be part of a dynamic team that thrives on collaboration and innovation, fostering a supportive and intellectually stimulating workplace.</li><li><b>
Impactful Work:</b> Your contributions will be pivotal in designing and optimizing defense systems that ensure national security and shape the future of space defense.</li></ul><p>
KBR is seeking a Vulnerability Researcher to support vulnerability discovery and validation efforts against embedded systems and firmware. In this role, you will focus on hands‑on vulnerability research, including building emulation‑backed test environments, developing fuzzing workflows, performing crash triage and root‑cause analysis, and assisting with proof‑of‑concept exploit development in a controlled lab setting.</p><p></p><p>
The Vulnerability Researcher works closely with reverse engineers and senior vulnerability researchers to deliver reproducible findings and high‑quality technical documentation for government customers while continuing to deepen technical proficiency across mission‑relevant domains.</p><p></p><p><b>
Key Responsibilities</b></p><ul><li>
Conduct vulnerability research on embedded targets using asset‑safe approaches such as emulation, virtualization, and controlled experimentation</li><li>
Develop and execute fuzzing campaigns, including target setup, fuzz harness development, seed/corpus management, and coverage‑driven testing</li><li>
Perform crash triage and root‑cause analysis to identify and characterize security vulnerabilities</li><li>
Assist in the development of proof‑of‑concept exploits to validate vulnerability impact in controlled laboratory environments</li><li>
Create and maintain test harnesses and supporting infrastructure to exercise payload delivery and validate behavior repeatably</li><li>
Reverse engineer firmware and binaries as needed to understand vulnerable code paths and exploitation constraints</li><li>
Collaborate with vulnerability researchers, reverse engineers, and developers support mission objectives</li><li>
Document findings and produce technical reports and artifacts suitable for release</li><li>
Research and apply new vulnerability research tools and techniques under senior technical guidance</li></ul><p></p><p><b>
Minimum Qualifications</b></p><ul><li><b>
Security Clearance:</b> Must have an active U.S. government Secret security clearance, which is something only a U.S. citizen can obtain</li><li>
Bachelor&rsquo;s degree in Computer Engineering, Electrical Engineering, Computer Science, or a related field</li><li>
4&ndash;9 years of experience in vulnerability research, reverse engineering, or exploit development</li><li>
Strong understanding of embedded systems, firmware, operating systems, and low‑level software behavior</li><li>
Proficiency in C/C++, Python, and assembly for vulnerability research, harness development, and automation</li><li>
Experience with embedded emulation environments</li><li>
Experience with coverage‑guided fuzzing, fuzz harness development, and crash triage workflows</li></ul><p></p><p><b><br>
Preferred Qualifications</b></p><ul><li>
Experience developing proof‑of‑concept exploits for vulnerability validation</li><li>
Exposure to analysis techniques such as symbolic execution, concolic execution, or taint analysis</li><li>
Experience with hardware‑focused vulnerability research or embedded security testing</li><li>
Demonstrated ability to communicate technical findings clearly in written reports</li></ul><p><b>
Basic Compensation: $99,200 - $130,000 (For Beavercreek, OH Only)</b><br>
The offered rate will be based on the selected candidate&rsquo;s knowledge, skills, abilities and/or experience and in consideration of internal parity.</p><p></p><p>
Belong, Connect and Grow at KBR<br>
<br>
At KBR, we are passionate about our people and our Zero Harm culture. These inform all that we do and are at the heart of our commitment to, and ongoing journey toward being a People First company. That commitment is central to our team of team&rsquo;s philosophy and fosters an environment where everyone can Belong, Connect and Grow. We Deliver &ndash; Together.</p><p></p><p>
KBR is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.</p></div><p></p>

Vulnerability Researcher

Legato, LLC

<div><p><b>Legato, LLC</b> recruiters (Staffing@legatocorp.com) would love to speak with you regarding the following position: <b>Vulnerability Researcher </b>in Dulles, VA.<br>
<b>Security Clearance Required</b>: TS/SCI minimum<br>
<b>**Some Remote Work May Be Available**</b></p>
<p><b>
What You Will Do:</b></p>
<p>
The team covers Our team covers the full life cycle of Vulnerability Research from reverse engineering and emulation, through vulnerability discovery, to productization and effects generation. Key areas of focus include: Hardware debugging using JTAG/gdb, Knowledge on typical embedded systems including UART, boot-up sequences, and updating devices, Reverse Engineering ARM, PPC, or Mips binaries, Discovering Vulnerabilities in firmware, device drivers, or in proprietary embedded operating systems, Repurposing vulnerabilities for specific effects, Static and dynamic Analysis, Fuzzer Development, Malware analysis, and System Emulation. There are a variety of non-traditional methods created to acquire access to computer based systems so the ideal candidate would be someone who enjoys trying new things. The most capable candidates will have a variety of low-level operating systems experience as well as cross-platform vulnerability research. If you've written everything from a kernel paged pool exploit to a simple userland stack-based buffer overflow, built your own adaptable instrumentation and integrated a solver to help you identify and reach code, or modified emulators and JIT engines to add your own instrumentation to help you identify entire classes of vulnerabilities, you'll be right at home.</p><p><br>
Our minimum requirements for this role:</p>
<ul>
<li>Active TS/SCI clearance.</li>
<li>Familiarity with at least one common low-level architecture (x86, ARM, etc) is important, as is the ability to conduct vulnerability research against applications compiled for that architecture.</li>
<li>Experience with software protection and binary armoring is a plus, and familiarity with modern exploit mitigation techniques and counter-measures is a must.</li>
<li>Experience with one of the four platforms: specific platform: Windows, Linux, iOS, embedded.</li>
<li>Development experience is desired, but at least some scripting experience is required. Whether in python, ruby, or some other language, you should be capable of quickly developing the instruments needed to help you succeed in your reverse engineering and vulnerability research efforts..</li>
<li>Candidates must be able to defeat advanced security techniques. Projects will be undertaken in small teams with close coordination with customers to quickly enhance capabilities or resolve issues in existing tools.</li>
<li>Working as part of a team you will also need to be familiar with source management tools such as GIT and team coordinating instruments like Atlassian suite of work products</li></ul><br>
<p></p>
<p><b>
About Your New Company</b><br>
Legato, LLC is a dynamic small business headquartered in Columbia, near Ft. Meade, MD. Our positions include Cyber, Software, Systems, Networking, Data Science and other complex engineering capabilities. We set ourselves apart by having employees in the top of their field and who enjoy working at Legato for its attention to its employees, aggressive compensation, and upward mobility possibilities.<br>
We offer a generous benefits package including individual and family health, vision and dental benefits. A minimum of four (4) weeks of paid time off including a week of sick leave. Legato gives our employees 11 federal holidays off and a 401(k) employer match with no vesting schedule. There is an opportunity to earn referral benefits or bank hours if the contract allows.</p>
<p>
Disclaimer: The salary range provided is an estimate based on current market conditions and may be adjusted based on factors such as experience, skills, and qualifications. The final salary offer will be determined after a thorough review of the candidate's background and alignment with the role. Please note that this range is subject to change and should be considered as a guideline rather than a definitive figure.</p><p><br>
<b>
Legato LLC is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, or disability status.</b></p></div>

Vulnerability Researcher (BZ)

NVIDIA

<div><p>We are now looking for an Offensive Hardware Security Researcher!</p><p></p><p>
NVIDIA is seeking an outstanding Offensive Hardware Security Researcher to work on a wide variety of security research challenges. Do you excel at thinking like an attacker, identifying hardware weaknesses, creating tools and automation for hardware vulnerability research? Join our team to hack the future, fortify the silicon frontier, and shape the destiny of groundbreaking chip technology!</p><p></p><p><b>
What you will be doing:</b></p><ul><li><p>
Research vulnerabilities on cutting-edge SoC and GPU designs</p></li><li><p>
Develop and use cutting-edge security tools and techniques</p></li><li><p>
Guide the continuous integration of latest mitigations into our security architecture</p></li><li><p>
Research and exploit side-channel, fault, and advanced physical attacks</p></li></ul><p></p><p><b>
What we need to see:</b></p><ul><li><p>
BS/BA degree in Computer Science or Computer Engineering or Electrical Engineering or equivalent experience</p></li><li><p>
6+ years of work experience in a Security related field</p></li><li><p>
Experience with ARM/RISCV assembly, Verilog and low-level C programming</p></li><li><p>
Understanding of large SoC and ASIC architecture and design</p></li><li><p>
Experience with security code reviews of complex firmware projects and defensive coding best practices (SDL, threat modeling)</p></li><li><p>
Ability to work collaboratively and remotely with multiple experts to accomplish complex goals</p></li><li><p>
Expertise in two of more of the following fields:</p><ul><li><p>
Expertise in side-channel analysis and mitigation for cryptographic primitives</p></li><li><p>
TEE (TrustZone, SE), Confidential Computing, and/or microarchitectural attacks</p></li><li><p>
Proficiency with Symbolic Execution and/or fuzzing tools</p></li><li><p>
JTAG, debugging, binary instrumentation frameworks, ChipWhisperer</p></li><li><p>
Reverse-engineering (IDA Pro, Ghidra)</p></li><li><p>
Practical experience in utilizing machine learning techniques for performing side-channel attacks</p></li></ul></li><li><p>
Track record of advancing offensive security research field through vulnerability discoveries, research publications, and/or developing security tools</p></li></ul><p></p><p><b>
Ways to stand out from the crowd:</b></p><ul><li><p>
Understanding of pre-silicon hardware design and testing</p></li><li><p>
Knowledge of key hardware security architecture components, and their implementation in complex SoC designs</p></li><li><p>
Strong background in computer architecture, especially GPU or AI accelerator design</p></li></ul><p></p><p>
Our invention of the GPU in 1999 sparked the growth of the PC gaming market, redefined modern computer graphics, and revolutionized parallel computing. More recently, GPU deep learning ignited modern AI &mdash; the next era of computing &mdash; with the GPU acting as the brain of computers, robots, and self-driving cars that can perceive and understand the world. Today, we are increasingly known as &ldquo;the AI computing company&rdquo;. With competitive salaries and a generous benefits package, NVIDIA is widely considered to be one of the technology world&rsquo;s most desirable employers. We have some of the most forward-thinking and hardworking people in the world working for us. If you're creative, autonomous and love a challenge, we want to hear from you!</p><p></p>
Your base salary will be determined based on your location, experience, and the pay of employees in similar positions. The base salary range is 184,000 USD - 287,500 USD for Level 4, and 224,000 USD - 356,500 USD for Level 5.<p></p><div><div><div><div><div><div><div><p>
You will also be eligible for equity and benefits.</p></div></div></div></div></div></div></div><p></p>
Applications for this job will be accepted at least until April 16, 2026.<p></p><p>
This posting is for an existing vacancy.</p><p>
NVIDIA uses AI tools in its recruiting processes.</p><p></p>
NVIDIA is committed to fostering a diverse work environment and proud to be an equal opportunity employer. As we highly value diversity in our current and future employees, we do not discriminate (including in our hiring and promotion practices) on the basis of race, religion, color, national origin, gender, gender expression, sexual orientation, age, marital status, veteran status, disability status or any other characteristic protected by law.</div><p></p>

Offensive Hardware Security Researcher

iHeartMedia

<div>iHeartMedia<p><br>
</p><p>Current employees and contingent workers click here <b>to apply and search by the Job Posting Title.</b></p><p><br>
</p><p>The audio revolution is here &ndash; and iHeart is leading it! iHeartMedia, <b>the number one audio company in America</b>, reaches 90% of Americans every month - a monthly audience that&rsquo;s <b>twice the size of any other audio company </b>&ndash; almost three times the size of the largest TV network &ndash; and almost 4 times the size of the largest ad-supported music streaming service. In fact, we have:</p><ul><li><p><b>
More #1 rated markets</b> than the next two largest radio companies combined;</p></li><li><p><b>
We&rsquo;re the largest podcast publisher</b>, with more monthly downloads than the second- and third-largest podcast publishers combined. Podcasting, the fastest-growing new media, today has more monthly users than streaming music services or Netflix;</p></li><li><p>
iHeart is <b>the home of many of the country&rsquo;s most popular and trusted on-air personalities and podcast influencers</b>, who build important connections with hundreds of communities across America;</p></li><li><p>
We create and produce some of <b>the most popular and well-known branded live music events</b> in America, including the iHeartRadio Music Festival, the iHeartRadio Music Awards, the iHeartCountry Festival, iHeartRadio Fiesta Latina and the iHeartRadio Jingle Ball Tour;</p></li><li><p>
iHeartRadio is the <b>#1 streaming radio digital service</b> in America;</p></li><li><p>
Our <b>social media footprint</b> is 7 times larger than the next largest audio service; and</p></li><li><p>
We have <b>the only complete audio ad technology stack in the industry for all forms of audio</b>, from on demand to broadcast radio, digital streaming radio and podcasting, which bring data, targeting and attribution to all forms of audio at an unparalleled scale. As a result, we&rsquo;re able to combine our strong leadership position in audience reach, usage and ad tech with powerful tools and insights for our sales organizations to help them build success for their clients at a more efficient cost than any other option.</p></li></ul><p></p><p>
Because we reach almost every community in America, we&rsquo;re committed to providing a range of programming that reflects the diversity of the many communities we serve &ndash; and our company reflects that same kind of diversity. Our company values stress collaboration, curiosity, welcoming dissent, accepting mistakes in the pursuit of new ideas, and respect for everyone.</p><p></p><p>
Only one company in America has the #1 position in everything audio: iHeartMedia!</p><p></p><p>
If you&rsquo;re excited about this role but don&rsquo;t feel your experience aligns perfectly with the job description, we encourage you to apply anyway. At iHeartMedia we are dedicated to building a diverse, inclusive, and authentic workplace and are looking for teammates passionate about what we do!</p><p><br>
</p><p><b>What We Need:</b></p>
You will serve as a technical subject matter expert with a strong focus on vulnerability management and a secure developer mindset. Your responsibilities will include designing, defining, and implementing security requirements, controls, and processes to facilitate the secure development and operation of cloud-based and on-premises applications. You will conduct architecture analysis, threat modeling, vulnerability assessments, and technical design reviews for sensitive features and infrastructure to identify risk and guide development and engineering teams in improving the overall security posture of our products.<br>
<br>
You will leverage your skills to develop process and automation for vulnerability detection, patch management, and remediation workflows. You will partner with application service teams to implement security standards, and guidelines, as well as educate developers on application and cloud security best practices. Additionally, you will help create, enhance, and maintain security documentation, providing guidance on vulnerability management processes, patching cycles, and zero-day response strategies.<br>
<br>
You will evaluate and recommend new and emerging security products and technologies related to vulnerability management, patch management, and cloud security.<p><br>
</p><p><b>What You'll Do:</b></p><ul><li><p>
Demonstrate leadership aptitude through mentoring and practice maturation.</p></li><li><p>
Work independently and collaboratively with various teams.</p></li><li><p>
Implement, onboard, and enforce vulnerability management tools and processes (including SAST, SCA, IaC, DAST, IAST) in cloud-based CI/CD pipelines.</p></li><li><p>
Coordinate software and cloud security initiatives with relevant teams.</p></li><li><p>
Conduct and build data flow diagrams &amp; threat modeling with application and infrastructure teams.</p></li><li><p>
Manage manual and automated vulnerability management for priority issues, including zero-day vulnerabilities.</p></li><li><p>
Develop and maintain patch management processes and schedules.</p></li><li><p>
Assist in developing source code review and vulnerability management checklists.</p></li><li><p>
Advise developers and engineers on secure coding and vulnerability mitigation strategies for DevSecOps CI/CD pipelines.</p></li><li><p>
Secure code repositories, release environments, and deployment tools.</p></li><li><p>
Perform application, cloud, and mobile penetration testing.</p></li><li><p>
Lead vulnerability management projects and collaborate with vendors to assess, implement, and utilize new security tools.</p></li></ul><p></p><p><br>
</p><p><b>What You'll Need:</b></p><ul><li><p>
Analytical mindset for problem solving, vulnerability prioritization, and offensive security tactics.</p></li><li><p>
Effective communication skills, both verbal and written, to clearly convey technical and non-technical concepts to diverse audiences.</p></li><li><p>
Current experience in vulnerability assessment, security testing, and remediation methodologies (including browser-based, API, CI/CD pipeline, mobile, and cloud environments).</p></li><li><p>
Developer focus and mid-level knowledge of tools such as Terraform, Kubernetes, Serverless functions, Jenkins, and cloud platforms (AWS, Azure, GCP).</p></li><li><p>
Experience in secure architectural design review, threat modeling, and technical design reviews.</p></li><li><p>
Expertise in patch management, vulnerability prioritization (CVSS, risk-based approaches), and zero-day vulnerability response.</p></li><li><p>
Strong knowledge of CI/CD processes and security tools for each stage, including SAST, SCA, IaC, DAST, IAST, and application penetration testing.</p></li><li><p>
Hands-on experience with vulnerability exploitation and remediation in applications and cloud environments.</p></li><li><p>
Familiarity with repository management (GitHub, TFS, AWS, Azure) and vulnerability management platforms.</p></li><li><p>
Experience with manual and automated vulnerability management and resolution across multiple teams.</p></li><li><p>
Strong understanding of securing cloud-based resources, including containers and basic services in AWS, GCP, or Azure.</p></li><li><p>
Knowledge of configuration and information management analysis (XML, JSON, etc.).</p></li><li><p>
Solid grasp of security principles, policies, and industry best practices.</p></li><li><p>
Familiarity with standards such as OWASP, SAMM, ASVS, NIST Special Publications.</p></li><li><p>
Minimum of 5 years&rsquo; experience in vulnerability management or application security.</p></li><li><p>
Minimum of 5 years&rsquo; experience in software development.</p></li><li><p>
Minimum of 5 years&rsquo; experience supporting security in CI/CD pipelines.</p></li><li><p>
Bachelor&rsquo;s Degree or 7 years developer experience with 3 years of vulnerability management or application security experience, or equivalent required.</p></li><li><p>
Certifications in Security, Kubernetes, Docker, AWS, or equivalent are a plus.</p></li><li><p>
Ability to stay focused and follow through on tasks in a timely manner.</p></li></ul><p><br>
</p><p><b>What You'll Bring:</b></p><ul><li><p>
Respect for others and a strong belief that others should do this in return</p></li><li><p>
Demonstrated initiative and achievement-oriented leadership</p></li><li><p>
Ability to manage several projects at a time</p></li><li><p>
Growth mindset and desire for continued knowledge sharing and learning</p></li><li><p>
Understanding of impact of your own decisions and decisions of your team</p></li><li><p>
Strong business insights that contribute to resolving complex problems</p></li><li><p>
Catalyst for new and innovative ideas</p></li><li><p>
Ability to identify and support new opportunities for continued improvement across business</p></li><li><p>
Ability to interact with individuals of all levels and maintain professional relationships</p></li><li><p>
Strong relationships with other leaders with the ability to manage external business partners where appropriate</p></li></ul><p><br>
</p><p><b>Location:</b></p>
San Antonio, TX: 20880 Stone Oak Parkway, 78258<p><br>
</p><p><b>Position Type:</b>
</p>Regular<p><br>
</p><p><b>Time Type:</b></p>
Full time<p><br>
</p><p><b>Pay Type:</b></p>
Salaried<p><br>
</p><p><b>Benefits:</b></p><p>
iHeartMedia&rsquo;s benefits offering is flexible and offers a variety of choices to meet the diverse needs of our changing workforce, including the following:</p><ul><li><p>
Employer sponsored medical, dental and vision with a variety of coverage options</p></li><li><p>
Company provided and supplemental life insurance</p></li><li><p>
Paid vacation and sick time</p></li><li><p>
Paid company holidays</p></li><li><p>
A Spirit day to encourage and allow our employees to more easily volunteer in their community</p></li><li><p>
A 401K plan</p></li><li><p>
Employee Assistance Program (EAP) at no cost &ndash; services include telephonic counseling sessions, consultation on legal and financial matters, emotional well-being, family and caregiving</p></li><li><p>
A range of additional voluntary programs, such as spending accounts, student loan refinancing, accident insurance and more!</p></li></ul><p><br>
</p><p>We are accepting applications for this role on an ongoing basis.</p><p></p><p>
The Company is an equal opportunity employer and will not tolerate discrimination in employment on the basis of race, color, age, sex, sexual orientation, gender identity or expression, religion, disability, ethnicity, national origin, marital status, protected veteran status, genetic information, or any other legally protected classification or status.</p><p></p><p>
Non-Compete will be required for certain positions and as allowed by law.</p><p></p><p>
Our organization participates in E-Verify. Click here to learn about E-Verify.</p></div>

Vulnerability Management, Manager

<div><p><b>Title:</b></p>
Reverse Engineer<p></p><p><b><i>
Belong. Connect. Grow. with KBR!</i></b></p><p>
KBR&rsquo;s National Security Solutions team provides high-end engineering and advanced technology solutions to our customers in the intelligence and national security communities. In this position, your work will have a profound impact on the country&rsquo;s most critical role &ndash; protecting our national security.</p><p><b>
Why Join Us?</b></p><ul><li><b>
Innovative Projects:</b> KBR&rsquo;s work is at the forefront of engineering, logistics, operations, science, program management, mission IT and cybersecurity solutions.</li><li><b>
Collaborative Environment:</b> Be part of a dynamic team that thrives on collaboration and innovation, fostering a supportive and intellectually stimulating workplace.</li><li><b>
Impactful Work:</b> Your contributions will be pivotal in designing and optimizing defense systems that ensure national security and shape the future of space defense.</li></ul><p></p><p>
KBR is seeking a Reverse Engineer to support reverse engineering and vulnerability research efforts across hardware, firmware, software, and networked systems. In this role, you will focus on strong technical execution, disciplined analysis, and effective collaboration within a team environment. The Reverse Engineer contributes to vulnerability discovery, tool development, and technical reporting while continuing to deepen technical proficiency and expand experience across mission‑relevant domains.</p><p></p><p><b>
Key Responsibilities:</b></p><ul><li>
Perform full‑scope reverse engineering of hardware, firmware, software, and network protocols</li><li>
Analyze system components, architectures, and interactions to understand functionality and security posture</li><li>
Identify and assess security vulnerabilities, potential attack vectors, and areas for improvement</li><li>
Develop tools and scripts to automate and enhance reverse engineering workflows</li><li>
Support vulnerability research and proof‑of‑concept development efforts under senior technical guidance</li><li>
Research emerging threats, vulnerabilities, and reverse engineering techniques</li><li>
Collaborate with reverse engineers, software engineers, and security analysts to support mission objectives</li><li>
Document findings and prepare technical reports and briefings for technical and non‑technical audiences</li><li>
Mentor junior team members through knowledge sharing and technical collaboration</li></ul><p><b>
Minimum Qualifications:</b></p><ul><li>
Bachelor&rsquo;s degree in Computer Engineering, Electrical Engineering, or a related field</li><li>
4&ndash;9 years of experience in reverse engineering, vulnerability research, or related security disciplines</li><li>
Strong understanding of computer architecture, operating systems, and software development principles</li><li>
Proficiency in assembly language, C/C++, Python, or other relevant programming languages</li><li>
Experience with reverse engineering tools such as IDA Pro, Ghidra, or Binary Ninja</li><li>
Familiarity with debugging tools and techniques</li><li>
Knowledge of network protocols, cryptography, and security vulnerabilities</li><li>
Ability to obtain and maintain a government security clearance</li></ul><p><b>
Preferred Qualifications:</b></p><ul><li>
Experience with hardware reverse engineering, firmware analysis, or embedded systems</li><li>
Experience with vulnerability research or exploit development</li><li>
Demonstrated ability to communicate technical concepts clearly and effectively</li></ul><p><b>
Basic Compensation: $99,200 - $130,000 (For Beavercreek, OH Only)</b><br>
The offered rate will be based on the selected candidate&rsquo;s knowledge, skills, abilities and/or experience and in consideration of internal parity.</p><p></p><p>
Belong, Connect and Grow at KBR<br>
<br>
At KBR, we are passionate about our people and our Zero Harm culture. These inform all that we do and are at the heart of our commitment to, and ongoing journey toward being a People First company. That commitment is central to our team of team&rsquo;s philosophy and fosters an environment where everyone can Belong, Connect and Grow. We Deliver &ndash; Together.</p><p></p><p>
KBR is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.</p></div><p></p>

Reverse Engineer

Cherokee Federal

<div><div><div><p><b>Vulnerability Management Team Lead
</b></p></div><div><p>Location: Alexandria, VA ( Remote) Clearance: Public Trust Employment Type: Full-time
</p></div><div><p><b>Overview
</b></p></div><div><div>Cherokee-Federal Systems, LLC is seeking an experienced cybersecurity professional to lead a risk ‑ driven vulnerability management program across hybrid on ‑ prem and cloud environments. The ideal candidate will possess deep expertise in infrastructure and security tools, apply critical thinking to identify security gaps, and develop and implement security protocols and risk management improvements. The qualified individual will own discovery, triage, remediation, and reporting of the agency&rsquo;s security posture and lead a small team of cybersecurity analysts to drive measurable reductions in vulnerabilities with Tenable for infrastructure, AppScan for applications, and ServiceNow for workflow and governance. Align operations to FISMA, FedRAMP, and CMMC. Drive measurable reduction in exploitability and clean audit outcomes.<br>
</div></div><div></div><div><p><b>Key Responsibilities
</b></p></div><div><ul><li><div>Lead endtoend vulnerability operations: scanning, validation, prioritization, remediation, exceptions, and verification across onprem , IaaS/PaaS, and SaaS.
</div></li></ul></div><div><ul><li><div>Operate and optimize Tenable (Nessus/Tenable.sc or Tenable.io) for servers, endpoints, network devices, containers, and cloud assets; maintain credentialed scans, schedules, and coverage for both vulnerabilities and configuration audits.
</div></li></ul></div><div><ul><li><div>Manage AppScan for web and API testing; integrate findings into SDLC and DevSecOps workflows; guide developers with reproducible issues and fix recommendations.
</div></li></ul></div><div><ul><li><div>Continue integration of Tenable, Explore/Implement integration of AppScan with ServiceNow Vulnerability Response:
</div></li></ul></div><div><ul><li><div>Autocreate tickets, enrich with asset data from CMDB, assign ownership by CI/service, and track to closure.
</div></li></ul></div><div><ul><li><div>Maintain riskbased SLAs by asset criticality and threat intel; monitor SLA adherence and escalate aging risk.
</div></li></ul></div><div><ul><li><div>Establish cloudspecific controls:
</div></li></ul></div><div><ul><li><div>Use CSP native scanners and posture tools (e.g., AWS Inspector, Azure Defender/Microsoft Defender for Cloud, GCP Security Command Center) and correlate with Tenable.
</div></li></ul></div><div><ul><li><div>Enforce secure configurations with CIS Benchmarks and cloud guardrails; remediate misconfigurations via IaC changes.
</div></li></ul></div><div><ul><li><div>Prioritize with CVSS, CISA KEV, exploit maturity, and exposure context ( internetfacing , privileged paths, highvalue assets).
</div></li></ul></div><div><ul><li><div>Govern exceptions: risk acceptance with compensating controls, timebound approvals, and periodic review.
</div></li></ul></div><div><ul><li><div>Produce executive and compliance reporting: exposure trends, SLA performance, timetoremediate , patch coverage, POA&amp;Ms, and audit artifacts aligned to FISMA/NIST RMF, FedRAMP, and CMMC.
</div></li></ul></div><div><ul><li><div>Partner with SOC/IR to correlate actively exploited vulnerabilities; enable rapid containment for highrisk findings.
</div></li></ul></div><div><ul><li><div>Coordinate patching windows and change management; champion continuous hardening for Windows/Linux, network, databases, and cloud services.
</div></li></ul></div></div><div><div><ul><li><div>Mentor analysts; mature automation, data quality, and process discipline; lead tabletop exercises for patching/vuln scenarios.
</div></li></ul></div><div><p><b>Required Qualifications
</b></p></div><div><ul><li><div>6+ years in cybersecurity with 3+ years leading vulnerability management in hybrid onprem /cloud environments.
</div></li></ul></div><div><ul><li><div>Handson expertise with Tenable (Nessus/Tenable.sc or Tenable.io), AppScan , and ServiceNow Vulnerability Response/CMDB integration.
</div></li></ul></div><div><ul><li><div>Strong grasp of CVE/CVSS, CISA KEV, exploit kits, and modern attack paths; able to translate technical risk to business impact.
</div></li></ul></div><div><ul><li><div>Familiarity with DAST, SAST, CI/CD and Cloud Assessments.
</div></li></ul></div><div><ul><li><div>Proven remediation leadership across Windows/Linux, network devices, containers, and cloud workloads (AWS/Azure/GCP).
</div></li></ul></div><div><ul><li><div>Experience aligning programs to FISMA (NIST 80053/80037 RMF), FedRAMP baselines, and CMMC practices.
</div></li></ul></div><div><ul><li><div>Metrics and reporting proficiency: exposure reduction, SLA compliance, MTTR for vulnerabilities, patch cadence, and POA&amp;M management.
</div></li></ul></div><div><ul><li><div>Clear, direct communicator comfortable with executive briefings and crossfunctional coordination.
</div></li></ul></div><div><p>Preferred Qualifications
</p></div><div><ul><li><div><b>Certifications: </b>Security+, CySA +, CISSP, CEH, GCSA, GCPN; Tenable or ServiceNow VR certifications; AppSec certs (GWAPT) a plus.
</div></li></ul></div><div><ul><li><div>Experience integrating Tenable with ServiceNow VR, CMDB, and change management; familiarity with Jira for developer workflows.
</div></li></ul></div><div><ul><li><div>Knowledge of CIS Benchmarks, NIST 80053, 80040 (patch), 80063, FedRAMP PMO guidance, and cloud security patterns.
</div></li></ul></div><div><ul><li><div>Scripting/automation (Python, PowerShell) for data normalization, ticket enrichment, API integrations, and reporting.
</div></li></ul></div><div><p><b>Key Competencies
</b></p></div><div><ul><li><div>Accountability and speed under pressure.
</div></li></ul></div><div><ul><li><div>Analytical rigor and validation discipline.
</div></li></ul></div><div><ul><li><div>Operational excellence and automation mindset.
</div></li></ul></div><div><ul><li><div>Crisp communication for technical and executive audiences.
</div></li></ul></div></div><div><div><ul><li><div>Collaborative leadership across security, IT ops, cloud, and development.
</div></li></ul></div><div><p>What Success Looks Like
</p></div><div><ul><li><div>Faster timetoremediate against riskbased SLAs; measurable reduction of critical/high exposure across onprem and cloud.
</div></li></ul></div><div><ul><li><div>Accurate asset inventory, clean CMDB linkage, and high scan coverage with low false positives.
</div></li></ul></div><div><ul><li><div>Auditready evidence with strong POA&amp;M management and clear control effectiveness.
</div></li></ul></div><div><ul><li><div>Executive visibility into vulnerability risk, trends, and remediation velocity.<br>
</div></li></ul><div></div><p><b>Keywords (5)
</b></p><ul><li>Vulnerability Management
</li><li>Tenable / Nessus
</li><li>AppScan
</li><li>ServiceNow (VR/CMDB)
</li>CVSS / Risk Scoring<br>
<li>
</li></ul><p></p><p>Similar Job Titles (5)
</p><ul><li>Vulnerability Management Lead
</li><li>Vulnerability Analyst
</li><li>Cybersecurity Engineer
</li><li>Security Operations Lead
</li>Information Security Manager<br>
<li>
</li></ul><p></p><div><div><b>Company Information:
</b></div></div><div><div><b>Cherokee Nation System Solutions (CNSS)</b>is a part of Cherokee Federal &ndash; the division of tribally owned federal contracting companies owned by Cherokee Nation Businesses. As a trusted partner for more than 60 federal clients, Cherokee Federal LLCs are focused on building a brighter future, solving complex challenges, and <b>serving </b>the government&rsquo;s mission with compassion and heart. To learn more about<b>CNSS</b>, visit cherokee-federal.com.<br>
</div></div><div></div><div><div><b>#CherokeeFederal #LI-SM2 #AppC<br>
</b></div></div><div></div><div><div>Cherokee Federal is a military friendly employer. Veterans and active military transitioning to civilian status are encouraged to apply.<br>
</div></div><div></div><div><div><b>Legal Disclaimer: </b>Cherokee Federal is an equal opportunity employer. Please visit cherokee-federal.com/careers for information regarding our Affirmative Action and Equal Opportunity Employer Statement, and Accommodation request.
</div></div><div><div>Many of our job openings require access to government buildings or military installations. Candidates must pass pre-employment qualifications of Cherokee Federal.</div></div></div></div></div><p></p>

Vulnerability Management Team Lead

Apple

<p>Apple Information Security is seeking an experienced security engineering manager to lead the Vulnerability Response team across the United States and EMEIA regions. Apple's external perimeter spans thousands of services relied upon by billions of users worldwide, and this team is responsible for continuously identifying, analyzing, and remediating vulnerabilities across that surface. You will combine hands-on technical leadership with people management, overseeing programs that include subcomponents of Apple's bug bounty program, proactive vulnerability discovery, WAF rule development, emerging threat response, and custom security<br>
<br>
tooling.<br>
<br>
You will play a critical role in protecting Apple's services and customers by ensuring timely and thorough response to security risks, fostering engineering excellence, and driving strategic initiatives that strengthen Apple's overall security posture. This role is both strategic and operational, requiring deep technical expertise, strong leadership, and the ability to manage a geographically distributed team operating in a continuous response environment.<br>
<br>
<b>Description</b><br>
<br>
As a manager on the Vulnerability Response team, you will lead the day-to-day operations of security engineers across the US and EMEIA regions, as well as oversee resources providing around-the-clock support. You will set team priorities, drive execution across multiple concurrent programs, and ensure operational continuity for a function that requires uninterrupted coverage. This includes direct participation in on-call escalation rotations, hands-on technical contributions such as penetration testing, variant analysis, security tool development, and strategic planning to evolve the team's capabilities over time.<br>
<br>
You will partner closely with teams across Apple to ensure coordinated and effective vulnerability response. You will represent the team in cross-functional forums, advocate for security improvements with engineering leadership, and contribute to the development of policies, processes, and tooling that scale the team's impact. You will also maintain the professional standards and reputation through oversight of researcher engagement,<br>
<br>
vulnerability adjudication, and program communications.&quot;,&quot;responsibilities&quot;:&quot;Team Leadership: Lead, mentor, and grow a geographically distributed team of security engineers across the US and EMEIA regions. Set goals, support professional development, and oversee resources providing around-the-clock Tier 1 support.<br>
<br>
Vulnerability Response Operations: Own the team's continuous vulnerability response function, including on-call escalation, emerging threat and zero-day assessment, and coordination of rapid remediation efforts across Apple's external perimeter.<br>
<br>
Vulnerability Discovery and Remediation: Drive proactive security assessment programs, including penetration testing, variant analysis, and large-scale scanning initiatives, to identify and remediate vulnerabilities before they are discovered or exploited by external parties.<br>
<br>
Security Program Management: Manage the lifecycle of external researcher engagement, report validation, risk assessment, and remediation coordination.<br>
<br>
Security Tooling and Automation: Guide the development and maintenance of custom security tools and automation that support vulnerability detection, analysis, and remediation tracking at scale, including the application of emerging technologies to increase operational efficiency.<br>
<br>
Cross-Functional Collaboration: Serve as a trusted security advisor to engineering, product, and leadership teams, partnering across security and infrastructure organizations to align vulnerability response priorities with broader security objectives and drive adoption of security improvements.<br>
<br>
<b>Preferred Qualifications</b><br>
<br>
Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent professional experience.<br>
<br>
Experience with cloud-native architectures, WAF technologies, and DNS security disciplines, with the ability to assess security implications across modern deployment and infrastructure environments.<br>
<br>
Background in applying AI and machine learning techniques to security operations, including automated analysis, classification, or remediation workflows.<br>
<br>
Relevant industry certifications such as CISSP, OSCP, OSCE, GPEN, or equivalent are helpful but not required.<br>
<br>
<b>Minimum Qualifications</b><br>
<br>
8+ years of experience in information security, with demonstrated expertise in vulnerability management, web application penetration testing, and incident response for large-scale internet-facing services, including 3+ years of people management experience leading and developing teams of security engineers.<br>
<br>
Strong technical proficiency in web application security, including hands-on experience identifying and remediating common vulnerability classes, and software development skills in one or more of Python, Go, or Bash.<br>
<br>
Experience managing or contributing to a vulnerability disclosure or bug bounty program, including researcher engagement, vulnerability validation, and coordinated disclosure processes.<br>
<br>
Experience with vulnerability scanning tools and methodologies at enterprise scale, including both commercial and open-source solutions.<br>
<br>
Demonstrated ability to manage geographically distributed teams across multiple time zones, with willingness to participate in on-call rotations, including weekends, as part of a tiered escalation model.<br>
<br>
Excellent written and verbal communication skills, with the ability to articulate complex security issues and risk to both technical and non-technical audiences.<br>
<br>
Apple is an equal opportunity employer that is committed to inclusion and diversity. We seek to promote equal opportunity for all applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, Veteran status, or other legally protected characteristics. Learn more about your EEO rights as an applicant .<br>
<br>
<b>Pay &amp; Benefits</b><br>
<br>
At Apple, base pay is one part of our total compensation package and is determined within a range. This provides the opportunity to progress as you grow and develop within a role. The base pay range for this role is between $208,400 and $313,500, and your base pay will depend on your skills, qualifications, experience, and location.<br>
<br>
Apple employees also have the opportunity to become an Apple shareholder through participation in Apple's discretionary employee stock programs. Apple employees are eligible for discretionary restricted stock unit awards, and can purchase Apple stock at a discount if voluntarily participating in Apple's Employee Stock Purchase Plan. You'll also receive benefits including: Comprehensive medical and dental coverage, retirement benefits, a range of discounted products and free services, and for formal education related to advancing your career at Apple, reimbursement for certain educational expenses - including tuition. Additionally, this role might be eligible for discretionary bonuses or commission payments as well as relocation. Learn more about Apple Benefits.<br>
<br>
Note: Apple benefit, compensation and employee stock programs are subject to eligibility requirements and other terms of the applicable plan or program.</p>

Service Delivery Manager - Apple Information Security

Search 499+ Vulnerability researcher jobs near you this April. New roles added regularly across leading industries. Apply today.