Description

JOB DESCRIPTION: Role purpose: Perform repository-level analysis and build focused utilities for Java/JVM findings. The role establishes code-path and configuration facts, supports defensible reachability decisions and automates recurring checks without becoming the final security-policy authority. Key responsibilities • Trace findings through source, call paths, build metadata, configuration and deployment assumptions to determine whether the reported path can execute. • Apply approved project or component patterns only after checking every applicability condition, and record project-specific exceptions. • Build analyzers, parsers, build adapters, evidence collectors and focused tests that reduce repetitive analyst effort. • Use Maven/Gradle and relevant JVM frameworks, or CMake/Bazel, native dependencies, sanitizers and debuggers according to the candidate's primary track. • Escalate novel, ambiguous or high-impact findings; multi-day exploit construction remains outside the revised scope. Mandatory requirements • Strong source comprehension and secure coding in Java/JVM or C/C++; one deep primary track is mandatory and familiarity with the other is desirable. • Repository debugging, unit/integration testing, dependency and build analysis, Git workflows and concise evidence capture. • Understanding of attacker-controlled data, reachable versus merely present code, defensive controls and configuration-dependent exposure. • Ability to work efficiently in unfamiliar OSS repositories and separate verified code facts from assumption.

Required Skills

Java, JVM

Key Skills

Education

Any Graduate