Vulnerability Researcher III

$260,000 - $300,000/Yr

Bts Software Solutions - Annapolis Junction, MD

Full-time - Senior

Annapolis Junction, MD

Professional, Scientific, and Technical Services

About the position

BTS Software Solutions is seeking a Vulnerability Researcher III to join their team in Annapolis Junction, MD. This role involves leading vulnerability research and reverse engineering efforts, actively debugging software, and developing proof-of-concept exploits. The position requires a strong understanding of system interactions and the ability to analyze software flaws, with a focus on creating robust exploits and participating in technical presentations.

Responsibilities

• Actively debug software and troubleshoot issues with software crashes and programmatic flow.
• Perform source code analysis to discover software flaws and document their impact and severity.
• Develop proof-of-concept exploits against research targets and demonstrate vulnerability analysis results.
• Lead reverse engineering and vulnerability research efforts.
• Edit, approve, and participate in technical presentations on assigned projects.
• Serve as a Subject Matter Expert and leader in at least one technology area related to reverse engineering and vulnerability analysis.

Requirements

• Experience programming in Assembly, C, C#, C++, Perl, or Python.
• Understanding of system interactions with libraries in production-style environments.
• Familiarity with Unix/Windows system APIs.
• Knowledge of virtual function tables in C++ and heap allocation strategies.
• Experience with large software projects and kernel programming (WDK/Unix/Linux).
• Proficiency in hardware/software reverse engineering using tools like IDA Pro, Ghidra, or Binary Ninja.
• Ability to identify and exploit common vulnerability patterns, including user-mode stack-based buffer overflows and heap-based exploitation strategies.

Nice-to-haves

• Experience with embedded device analysis and software stack identification.
• Demonstrated ability to discover multiple previously unknown vulnerabilities (0-day) across various technologies.

Benefits

• 100% Company PAID health benefits
• Paid time off (PTO)
• 401(k) matching vested from day one