Vulnerability Researcher

The SEI helps advance software engineering principles and practices and serves as a national resource in software engineering, computer security, and process improvement. The SEI works closely with defense and government organizations, industry, and academia to continually improve software-intensive systems. Our core purpose is to help organizations improve software engineering capabilities and develop or acquire the right software, defect free, within budget and on time, every time.

The CERT Division of the Software Engineering Institute (SEI) is seeking applicants for the Vulnerability Researcher role. The Vulnerability Analysis Team, within the Threat Analysis Directorate, is a group of internet security experts focused on advancing the state of the art in vulnerability assessment and discovery, coordinated vulnerability disclosure, and software security on a national and global scale. We participate in communities of network defenders, software developers and vendors, security researchers, and policy-makers. We publish security advisories, papers, blog posts, data, and tools. The SEI is a federally funded research and development center at Carnegie Mellon University.

What you'll do

• Develop state of the art approaches for analyzing executable code.
• Apply these approaches to understanding systemic vulnerabilities in software systems and how attackers adapt their tradecraft to exploit those vulnerabilities.
• Study and influence the software security and vulnerability disclosure ecosystems.
  Evaluate the effectiveness of tools, techniques and processes developed by industry and the security research community.
• Uncover some of the fundamental assumptions underlying current best practice in software security.
• Develop models, tools and data sets that can be used to characterize the threats to, and vulnerabilities in, software systems, and publish those results. You will also use these results to aid in the testing, evaluation and transition of technologies developed by government-funded research programs.

Who you are

• You have a deep interest in cybersecurity, intellectual curiosity and a desire to make an impact beyond your organization.
• You enjoy developing and communicating innovative ideas and thinking creatively to solve tough problems.
• You relate collaboratively and diplomatically with people inside and outside the organization.
• You have a strong understanding of research methods in computer science, engineering and security, and related fields as well as of Internet fundamentals including network protocols, provider operations and governance.
• You enjoy mentoring and training others as well as sharing knowledge.

You have experience

• Vulnerability research, analysis, disclosure, and mitigation
• Applying knowledge of technology, systems architecture and security best practice to practical problems in enterprise security.
• Advising on a range of security topics based on research and expert opinion.
• Organizing and planning complex projects
• Communicating complex system designs, technical approaches and road maps to sponsors, project managers and technical staff, and the ability to distill the implications of complex research results and apply those results to government operations.
• Applying modern data-driven research methods to cost-effectiveness analysis, risk analysis and information security decision making and collaborating on industry and academic community projects.
• Developing software in Python and other modern programming languages
• Mathematical programming, statistical modeling, or machine learning
• Recognizing and properly handling confidential and sensitive information.
• Applying cybersecurity knowledge to areas such as AI/ML domain and open-source software
• Automating existing security practices

You are able to

• You have BS in Computer Science, Information Science, or Analytical discipline with eight (8) years of experience; OR MS in the same fields with five (5) years of experience; OR PhD in the same fields with two (2) years of experience.
• You have a willingness to travel to various locations to support the SEI's overall mission. This includes sponsor sites, conferences, and offsite meetings on occasion. Moderate Travel (15%)
• You will be subject to a background check and obtain and maintain an active Department of Defense security clearance. Applicants for this position must be currently legally authorized to work for CMU in the United States. CMU will not sponsor or take over sponsorship of an employment visa for this opportunity.

Why work here?

• Join a world-class organization that has significant impact on software.
• Work with cutting edge technologies and experts to solve tough problems for the government and the nation.
• Get 8% monthly contribution for your retirement, without having to contribute yourself.
• Get tuition benefits to CMU and other institutions for you andyour dependent children.
• Enjoy a healthy work/life balance withflexible work arrangements and paid parental and military leave.
• Get access to university resources including mindfulness programs, childcare and back-up care benefits, a monthly transit benefit on WMATA, free transportation on the Pittsburgh Regional Transit System.
• Enjoy annual professional development opportunities; attend conferences and training or obtain a certification and get reimbursed for membership in professional societies.
• Qualify for relocation assistance and so much more.

Location

Job Function

Position Type

Full time/Part time

Pay Basis

• Please visit "" to learn more about becoming part of an institution inspiring innovations that change the world.

• Click to view a listing of employee benefits

• Carnegie Mellon University is an Equal Opportunity Employer/Disability/Veteran.