Application Security Engineer – CVE & Vulnerability Research

Overview

Review real-world software vulnerabilities, CVE reproductions, remediation approaches, and exploit verification environments. Determine whether vulnerabilities are reproduced accurately, fixes address the root cause, and security tests demonstrate that exploits have been mitigated.

What you'll do

• Review CVE reproduction environments for technical accuracy.
• Determine whether vulnerabilities faithfully reproduce the original attack vector and impact.
• Evaluate proposed security fixes and remediation strategies.
• Review test suites to verify that normal application functionality remains intact.
• Review test suites to verify that the original exploit no longer succeeds.
• Identify incomplete fixes and alternative exploitation paths.
• Review Docker environments for correct software versions, services, networking, and configuration.
• Detect potential regressions or new vulnerabilities introduced by a fix.
• Provide recommendations for improving vulnerability reproductions, fixes, and verification logic.
• Review CVE vulnerability reproductions, exploit proof-of-concepts, vulnerability remediation and secure coding, application security testing, Docker-based vulnerability labs, exploit verification scripts, security regression testing, CVSS, CWE and vulnerability classification, environment and configuration analysis, and edge cases and alternative attack paths.

What you'll need

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research.
• Strong understanding of CVE, CVSS, CWE, and common vulnerability classes.
• Experience identifying and remediating SQL injection, command injection, SSRF, deserialization vulnerabilities, buffer overflows, privilege escalation, access control issues, and security misconfigurations.
• Strong understanding of secure coding and vulnerability remediation.
• Experience reviewing or developing exploit proof-of-concepts.
• Experience validating whether security fixes address the root cause rather than only the immediate exploit.
• Proficiency with Docker and Docker Compose.
• Ability to provide clear, technically rigorous written feedback.

Nice to have

• OSCP, GPEN, GWAPT, or equivalent security certification.
• Experience with responsible vulnerability disclosure or CVE reporting.
• Experience maintaining exploit proof-of-concept code.
• Experience writing automated security tests using Python, requests, curl, pwntools, or custom exploit harnesses.
• DevSecOps experience.
• Familiarity with SAST, DAST, and CI/CD security tooling.
• Experience developing or reviewing cybersecurity assessments or technical security challenges.
• Experience with AI evaluation, RLHF, or technical data projects.

Details

• Location: Argentina.
• Work mode: Fully remote.
• Work type: Part-time.
• Engagement: Project-based consulting.
• Focus: Application security, vulnerability research, CVE reproduction, and remediation.