Description

JOB DESCRIPTION

Role purpose
Perform repository-level analysis and build focused utilities for Java/JVM findings. The role establishes code-path and configuration
facts, supports defensible reachability decisions and automates recurring checks without becoming the final security-policy authority.
Key responsibilities
• Trace findings through source, call paths, build metadata, configuration and deployment assumptions to determine whether the reported
path can execute.
• Apply approved project or component patterns only after checking every applicability condition, and record project-specific exceptions.
• Build analyzers, parsers, build adapters, evidence collectors and focused tests that reduce repetitive analyst effort.
• Use Maven/Gradle and relevant JVM frameworks, or CMake/Bazel, native dependencies, sanitizers and debuggers according to the
candidate's primary track.
• Escalate novel, ambiguous or high-impact findings; multi-day exploit construction remains outside the revised scope.
Mandatory requirements
• Strong source comprehension and secure coding in Java/JVM or C/C++; one deep primary track is mandatory and familiarity with the other
is desirable.
• Repository debugging, unit/integration testing, dependency and build analysis, Git workflows and concise evidence capture.
• Understanding of attacker-controlled data, reachable versus merely present code, defensive controls and configuration-dependent
exposure.
• Ability to work efficiently in unfamiliar OSS repositories and separate verified code facts from assumption

Required Skills
C++
C
 

Key Skills

Education

Any Graduate