CVE Vulnerability Expert | $70-$90/hr Remote
Overview
You will review vulnerability-reproduction and remediation assignments that feed the training and evaluation pipeline of a frontier AI lab. Each assignment asks you to judge whether CVE reproductions match the real-world flaw, whether the proposed fix actually eliminates the risk, and whether the verification logic can catch a regression. You will also inspect Docker Compose environments to confirm they recreate the exploitable condition described in the CVE. The output is a structured, rubric-based evaluation that shapes how the lab improves its model training data. The role is a remote, hourly engagement for security professionals based in the United States.
What You'll Do6
- 1Review CVE reproduction reports and determine whether the documented exploit steps match the real-world vulnerability.
- 2Scrutinize proposed remediation code and flag any fix that leaves part of the underlying weakness open or introduces new problems.
- 3Evaluate the strength of two-part verification suites, checking both the functionality test and the vulnerability test for blind spots.
- 4Run and inspect Docker Compose lab environments to confirm they reproduce the exact exploitable condition described in the CVE.
- 5Assign severity and classification scores using frameworks like CVSS, CWE, and CAPEC when judging the reproduction's completeness.
- 6Write clear, rubric-based evaluation notes that explain each scoring decision and highlight concrete gaps for the task authors.
Requirements9
- 1At least 3 years of hands-on application security, penetration testing, or vulnerability research experience.
- 2Working familiarity with CVE taxonomy and severity scoring, including CVSS, CWE, and CAPEC.
- 3Demonstrated skill in secure coding review and remediation across vulnerability classes such as SQL injection, command injection, buffer overflow, deserialization, SSRF, and privilege escalation.
- 4Experience designing or evaluating two-part verification logic: a functionality test paired with a vulnerability test.
- 5Practical knowledge of Docker and Docker Compose for building multi-container environments that reproduce exploitable conditions.
- 6An offensive security certification such as OSCP, GPEN, or GWAPT.
- 7Prior work in responsible disclosure, CVE submission, or maintaining exploit proof-of-concept code.
- 8Experience with DevSecOps, CI/CD security gating, or SAST/DAST tooling.
- 9Previous involvement in technical content review, assessment design, or QA for security-focused engineering tasks.
Who Should Apply
The ideal candidate is a security practitioner who has spent years reproducing vulnerabilities and judging whether patches close the hole. If you can inspect a Docker Compose lab and see right away whether the exploit condition is realistic, this contract fits you. This role is less suitable for security engineers who focus on building defenses and have limited exposure to exploit development or CVE analysis. Candidates often get screened out when their background leans toward policy or GRC instead of hands-on exploitation. Another common miss is being unable to explain how a verification suite can pass while the underlying vulnerability remains.
Salary Insight
The contract pays $70-$90 per hour. For a security review role requiring CVE reproduction and exploit logic expertise, that rate sits at the senior end of independent consulting rates in the U.S. market. The pay band reflects the specialized nature of the evaluation and the expectation of fast, high-quality technical judgment.
Location
Required Skills
Application Tip
In your application, describe one CVE you have reproduced or reviewed and walk through how you would evaluate its verification logic. Name the exact Docker setup and the frameworks you applied, and be ready to explain why a specific remediation was either sound or incomplete.
See NearSkill jobs more often in your search
How your application is processed
1Application received
Your resume and details are logged the moment you apply.
2ATS + eligibility screening
We check your profile against the role’s skills, seniority, and requirements.
3Employer sees qualified profiles only
Only candidates who clear screening move forward.
Similar open positions
Explore active roles that match your skills and interests.
Micro1
VerifiedVulnerability Researcher and Staff Security Engineer
Remote role for a vulnerability researcher and staff-level security expert who operates as an internal adversary to uncover novel attack paths. You’ll study threats across AI agents, cloud infrastructure, developer platforms, and production systems, then collaborate with engineering to raise the stack’s resilience. Expect to build offensive tooling and publish internal research to shape security strategy. The position is full-time and focused on practical, hands-on security work in a remote setting. Bold Multi-Cloud, Red Teaming, AI security.
Mercor
VerifiedCybersecurity Research Expert – Offensive Security & Vulnerability Research
Mercor is hiring experienced Cybersecurity Research Experts to test how well frontier AI models handle advanced security reasoning, vulnerability analysis, and exploit development. In this remote, hourly contract role, you'll review AI-generated security assessments, validate root-cause findings, and help build benchmarks that push AI security capabilities forward. This is a fit for practitioners with a strong track record in offensive security and a public portfolio of technical contributions.
Micro1
VerifiedRed Team Lead (Offensive Cybersecurity)
This remote contractor role with micro1 puts your offensive cybersecurity expertise to work in a unique way: you'll help train next-generation AI systems by designing evaluation frameworks and attack simulations. No prior AI experience is required—your hands-on knowledge of exploit chains, cloud/appsec, and social engineering is what makes you the ideal candidate. You'll shape how models learn about real-world threats while operating under strict ethical boundaries.
Micro1
VerifiedPenetration Tester
micro1 is looking for an experienced penetration tester to contribute your security expertise to the development of next-generation AI systems. You won't need an AI background — your hands-on knowledge of ethical hacking and vulnerability assessment is exactly what's needed to help train smarter models. This is a remote contract opportunity paying $25–$80 per hour.
Micro1
VerifiedCyber Security Analyst
This role lets you put your cybersecurity expertise to work in a unique way—helping train next-generation AI systems. You won't need any prior AI experience; your domain knowledge in security is what counts. As a part-time, remote contractor, you'll test and guide AI models through hands-on prompts and analysis.
Mercor
VerifiedExpert Interviewer
Mercor supports a frontier AI lab's high-priority technical-expert panel. The interviewer in this role vets shortlisted engineers across GPU kernel development, security & vulnerability research, and ML-compiler / accelerator domains. You run structured 20-minute interviews, score each candidate against a rubric, and provide an evidence-based read. The engagement is part of an AI model training-and-evaluation effort and operates 100% remote.