CVE Vulnerability Expert at Mercor

CVE Vulnerability Expert | $70–90/hr | Remote (US)

Join a cutting-edge AI research initiative where your security expertise directly shapes the quality of frontier AI model training. As a CVE Vulnerability Expert, you will evaluate the accuracy, completeness, and rigor of vulnerability-reproduction and remediation tasks — ensuring AI models are trained on high-fidelity, real-world security content.

What You'll Do

• Assess whether CVE reproductions faithfully reflect real-world exploitable conditions
• Evaluate the soundness of proposed security fixes and remediation strategies
• Review two-part verification logic (functionality tests + vulnerability tests) for rigor and correctness
• Audit Docker-based lab environments to confirm they accurately recreate exploitable scenarios
• Provide clear, rubric-based written feedback to guide task quality improvements

Required Qualifications

• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
• Strong command of CVE taxonomy and severity frameworks (CVSS, CWE, CAPEC)
• Demonstrated expertise in secure coding and remediation across common vulnerability classes — including SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, and privilege escalation
• Experience designing or evaluating verification logic for security tasks
• Proficiency with Docker and Docker Compose for multi-container environments

Preferred Qualifications

• OSCP, GPEN, GWAPT, or equivalent offensive security certification
• Experience with CVE disclosure, responsible vulnerability reporting, or maintaining exploit proof-of-concept code
• Background in DevSecOps, CI/CD security gating, or SAST/DAST tooling
• Prior experience in technical content review, assessment design, or QA for security engineering tasks

This is a fully remote, hourly contractor role open to candidates based in the United States.