Cybersecurity Research Expert – Offensive Security & Vulnerability Research
Listing checked August 29, 2026 · pay as published by Mercor
Overview
Mercor is hiring experienced Cybersecurity Research Experts to test how well frontier AI models handle advanced security reasoning, vulnerability analysis, and exploit development. In this remote, hourly contract role, you'll review AI-generated security assessments, validate root-cause findings, and help build benchmarks that push AI security capabilities forward. This is a fit for practitioners with a strong track record in offensive security and a public portfolio of technical contributions.
What You'll Do5
- 1Review AI-generated security analyses for technical accuracy, real-world exploitability, and completeness.
- 2Assess technical writeups to confirm whether reported exploit paths are viable and whether suggested mitigations actually reduce risk.
- 3Validate root-cause explanations for vulnerabilities across operating systems, networking, cloud environments, and web applications.
- 4Deliver structured feedback on security reasoning, exploit chain logic, and the strength of defensive recommendations.
- 5Contribute to the design and refinement of benchmarks that measure advanced security capabilities in AI systems.
Requirements8
- 1A track record in offensive security research, backed by a mix of credentials from CTF competitions, CVE disclosures, and accepted bug bounty findings.
- 2Publicly recognized contributions such as CVEs affecting widely used open-source or commercial software, or bug bounty results accepted by major programs like Google, Microsoft, Apple, Meta, GitHub, Mozilla, Chromium, Kubernetes, or the Linux Foundation.
- 3Research experience at a respected security lab, academic research group, or comparable industry organization, plus high-quality publications, conference papers, or widely cited technical writeups.
- 4Working knowledge of exploit development, reverse engineering, binary analysis, and vulnerability research across operating systems, networks, web applications, or cryptography.
- 5Hands-on familiarity with reverse engineering tools such as IDA Pro, Ghidra, Binary Ninja, or Radare2, and experience with fuzzing, symbolic execution, static analysis, or dynamic analysis frameworks.
- 6Relevant professional experience in application security, product security, security engineering, or vulnerability research.
- 7Strong programming ability in C/C++, Rust, Python, Go, or Java, along with clear technical writing skills.
- 8Nice-to-have credentials include OSCP, OSEP, OSCE3, or GIAC certifications, conference presentations at Black Hat, DEF CON, USENIX Security, IEEE S&P, ACM CCS, or NDSS, and contributions to well-known open-source security tools.
Who Should Apply
This role is for seasoned security researchers who have visible proof of their offensive security expertise — whether that's top-ranked CTF performance, authored CVEs, bug bounty hall-of-fame recognition, or published security research. You should be someone who enjoys pressure-testing AI-generated technical output, can explain complex security reasoning clearly in writing, and works well independently in a remote, project-based setup.
Salary Insight
Compensation is $200.00 - $250.00 per hour for this remote hourly engagement.
Pay and demand for Cybersecurity roles
AggregatedTypical pay
$82/hour
This role
$200–$250/hr
Most Cybersecurity roles pay $65–$100 per hour. This role's pay sits above that range.
Based on 123 similar roles that publish pay · 12 publish only a top rate; those count at the rate they gave
Rates shown per hour. Yearly and monthly pay converted; one-time fees and non-USD pay are not included.
- Live similar roles
- 155
- Listed in last 30 days
- 102
- Remote
- 92%
Hiring most right now: micro1 (55) · Mercor (25) · Handshake AI (20)
Most requested skills · share of roles
- technical writing22%
- matlab10%
- python10%
- mechanical engineering10%
Figures from Cybersecurity roles live on NearSkill when this page loaded. A role can close before you apply, so check the listing itself.
Compare your resume against these rolesLocation
Compensation
$200–250/hr
Required Skills
Application Tip
Make your proof of work impossible to miss: put CVE IDs, CTF team rankings, and named bug bounty programs at the top of your resume, and link to your talks, papers, or technical writeups. Concrete, verifiable contributions will set you apart far more than a generic credential list.
How NearSkill helps you apply
1. Check your job match
We compare your resume with the job requirements to help you understand how well your experience fits.
2. Continue to the employer’s website
We’ll direct you to the employer’s application portal, where you can complete the application.
3. Get updates by email
If NearSkill is handling follow-up for this role, we’ll email you when there’s an update on your screening.
Want to check your fit first?
See how your resume matches this role before applying.
Check my job matchSimilar open positions
Explore active roles that match your skills and interests.
AfterQuery
VerifiedCybersecurity Expert
AfterQuery seeks a Cybersecurity Expert for a paid, part-time remote project that trains frontier AI models on security workflows. The core work involves building code repositories with OSS-fuzz-style vulnerabilities, then writing and validating patches that fix them. Tasks run async, so you can schedule them around a full-time job, evenings or weekends. The listing quotes $75.00/hr, and project notes mention per-task bonuses plus a $200 referral bonus for qualified experts.
Micro1
VerifiedVulnerability Researcher and Staff Security Engineer
Remote role for a vulnerability researcher and staff-level security expert who operates as an internal adversary to uncover novel attack paths. You’ll study threats across AI agents, cloud infrastructure, developer platforms, and production systems, then collaborate with engineering to raise the stack’s resilience. Expect to build offensive tooling and publish internal research to shape security strategy. The position is full-time and focused on practical, hands-on security work in a remote setting. Bold Multi-Cloud, Red Teaming, AI security.
AfterQuery
VerifiedSecurity Engineer - Cryptanalysis (Remote Contract)
AfterQuery is assembling a research cohort of senior security specialists to test how frontier AI models handle advanced problems in cryptanalysis and reverse engineering. The work centers on evaluation, not production engineering. You will define what a correct or excellent answer looks like for problems you already solve in practice, then judge model output against that bar. The project runs remote and asynchronous, with flexible hours that fit around your current role. Candidates with 6 to 10 years of security experience and a Bachelor's degree, with a Master's preferred, move to the front of the review queue.
Micro1
VerifiedCyber Security Engineer
micro1 is hiring Cyber Security Engineers to bring hands-on security and coding skills to a customer project that trains next-generation AI systems. You will work across Python3, Java, Rust, Go, C++, or TypeScript codebases, hunting bugs, fixing vulnerabilities, and running pentesting and security audits. The schedule is fully flexible, about 15 hours a week, and you can pick your own days, including weekends. No AI background is needed. What matters is your domain knowledge and your ability to document findings that improve how models learn and reason.
Mercor
VerifiedCybersecurity Practitioner Interviews
Mercor is building a benchmark to test how AI agents handle real enterprise cyber defense work. Before the benchmark takes shape, the team wants to hear from people who do that work day to day. You would join two or three one-hour video calls over about four weeks, paid per hour, with no prep and nothing to build, label, or submit. The conversations center on your actual workflows: the tools you use, what lands in your queue, how your team judges a SOC triage or containment action, and where AI helps or hinders. Experience with an EDR and SIEM stack is a plus.
Mercor
VerifiedCVE Vulnerability Expert
You will review vulnerability-reproduction and remediation assignments that feed the training and evaluation pipeline of a frontier AI lab. Each assignment asks you to judge whether CVE reproductions match the real-world flaw, whether the proposed fix actually eliminates the risk, and whether the verification logic can catch a regression. You will also inspect Docker Compose environments to confirm they recreate the exploitable condition described in the CVE. The output is a structured, rubric-based evaluation that shapes how the lab improves its model training data. The role is a remote, hourly engagement for security professionals based in the United States.