Software Vulnerability Analyst

About the position

The position requires a candidate with a broad knowledge of various vulnerability types and exploitation techniques. The individual will be responsible for summarizing vulnerability discovery reports into CVE records, necessitating strong analytical and writing skills. The role also involves interacting with a diverse set of requesters, including vulnerability researchers, vendors, end users, and academics from around the world, highlighting the need for effective interpersonal skills. Additionally, the candidate should be capable of reading code in languages such as PHP, Python, and C/C++, with the ability to identify weaknesses within the code, although writing code is not a required skill. The position demands the ability to interpret outputs from vulnerability reporting tools, such as stack traces and crash reports, and a solid understanding of general security models across various technologies, including networking, applications, cryptology, web, embedded systems, and kernel security. Familiarity with the Coordinated Vulnerability Disclosure (CVD) process and the role of CVEs within it is also essential. The candidate should possess the analytical and interpersonal skills necessary to manage disputes regarding the classification of findings as vulnerabilities.

Requirements

• Broad knowledge of vulnerability types and exploitation techniques.
• Analytical and writing skills to summarize vulnerability discovery reports into CVE records.
• Interpersonal skills to interact with a diverse set of requesters from around the world.
• Ability to read code (e.g., PHP, Python, C/C++) and identify weaknesses within it.
• Capability to interpret the output of vulnerability reporting tools (stack traces, crash reports, etc.).
• Understanding of general security models for a broad range of technologies (networking, applications, cryptology, web, embedded, kernel, etc.).
• Knowledge of the Coordinated Vulnerability Disclosure (CVD) process and the role of CVEs within it.
• Analytical and interpersonal skills to handle disputes regarding vulnerability findings.