Vulnerability Research Analyst
Two Six Technologies27 days ago
Linthicum, MD, USAMid Level
Base Salary
$158k - $237k/yr
Responsibilities
- Perform static and dynamic software vulnerability analysis on extracted COTS/GOTS source code and firmware images.
- Deploy AI-guided fuzzing and automated vulnerability detection tools to identify high-risk logic flaws.
- Trace code execution paths to validate tool findings, determine root causes, and assess real-world exploitability.
- Develop CodeQL queries, Semgrep rules, and AST-based detection signatures for new bug patterns and regression testing.
- Present vulnerability perspectives, risk assessments, and testing metrics to program managers, stakeholders, and intelligence-community partners.
Requirements
- Active US Top Secret/SCI security clearance with polygraph and willingness to obtain and maintain a polygraph clearance.
- Degree in Computer Science, Computer Engineering, Information Security, or equivalent practical experience.
- Experience in vulnerability research, static source-code analysis, reverse engineering, or software security audits.
- Understanding of memory management, pointer arithmetic, and common security flaws in compiled and managed languages.
- Familiarity with automated static and dynamic code analysis concepts and AI-driven automation tools.
- Preferred experience authoring custom analysis rules with CodeQL, Semgrep, or Tree-sitter; using firmware emulation tools; creating test drivers, stubs, and harnesses; applying machine learning to automated bug discovery; or delivering assessments for DoD or intelligence-community programs.
Benefits
- Medical, dental, and vision insurance.
- Life and disability insurance.
- Retirement benefits, paid leave, tuition assistance, and professional development.
- The position is listed as onsite.
- Annualized salary range of $157,847–$236,771 USD.
Categories
About Two Six Technologies
Two Six Technologies builds cybersecurity, information operations, data science, and microelectronics software and hardware for U.S. national-security customers, delivering deployable products and applied R&D. Its portfolio spans secure communications, hardware security, and analytics, sold primarily through government contracts. Founded in 2021 and headquartered in Arlington, Virginia, the company’s customers have included DARPA, the Department of State, U.S. Cyber Command, and the Department of Homeland Security.