Vacancies
iOS Security Research
Responsibilities
- Perform tasks assigned to the team, including iOS kernel research, reverse engineering of closed-source components, smartphone debugging, vulnerability assessment and proof-of-concept exploitability testing, writing functional exploits, and chaining exploits.
- Participate in the testing process of developed exploits, modify and update them with new software versions.
- Propose ideas to the team and participate in discussions on new developments and research.
Key Requirements
- Ability to learn quickly, analyze large amounts of scattered information and synthesize it into concrete knowledge, possess systemic thinking.
- Ability to work and make decisions under conditions of limited information, no fear of formulating hypotheses, testing them, and abandoning non-working ideas.
- Ability to focus on tasks that require a significant amount of time to solve, up to several months. Ability to maintain productivity and not give up when a task seems impossible.
Requirements
- Proven experience in writing exploits or finding critical vulnerabilities (Remote Code Execution, Privilege Escalation, Sandbox Escape, Mitigation Bypasses — RCE, LPE, SBX, mitigation bypasses) in iOS within the last year.
- Understanding of XNU architecture and internals: Mach, BSD, IOKit, threading, scheduling, memory management, IPC, kernel extensions (kext), kernel modules, DriverKit.
- Proficiency in programming languages and tools: ARM and AArch64 assembler, C, C++, Objective-C, IDA Pro, Ghidra, Hopper, LLDB, lldbinit, Frida, Clang/LLVM, Xcode.
- Experience debugging iPhone and MacBook devices: JTAG, ktrace, sysdiagnose; ability to analyze crash dumps and kernel panics and identify the root cause.
- Experience studying and practically using jailbreaks and Coruna and DarkSword exploit chains.
- Knowledge of modern iOS protection mechanisms: KPP, KTRR, PAC, PPL, SPTM, SEP, code signing, AMFI, keychain, etc.
- Ability to configure and use LLMs for automating research tasks.
- Will be an advantage: experience writing macOS kernel-mode drivers, vulnerability research experience, knowledge of Swift.
- English language proficiency at the level of reading technical documentation.
Android Security Research
Responsibilities
- Perform tasks assigned to the team, including Android kernel research, reverse engineering of closed-source components, smartphone debugging, vulnerability assessment and proof-of-concept exploitability testing, writing functional exploits, and chaining exploits.
- Participate in the testing process of developed exploits, modify and update them with new software versions.
- Propose ideas to the team and participate in discussions on new developments and research.
Key Requirements
- Ability to learn quickly, analyze large amounts of scattered information and synthesize it into concrete knowledge, possess systemic thinking.
- Ability to work and make decisions under conditions of limited information, no fear of formulating hypotheses, testing them, and abandoning non-working ideas.
- Ability to focus on tasks that require a significant amount of time to solve, up to several months. Ability to maintain productivity and not give up when a task seems impossible.
Requirements
- Proven experience in writing exploits or finding critical vulnerabilities (Remote Code Execution, Privilege Escalation, Sandbox Escape, Mitigation Bypasses — RCE, LPE, SBX, mitigation bypasses) in Android within the last year.
- Understanding of Android and Linux kernel architecture and internals.
- Knowledge of current vulnerability classes and mitigation mechanisms.
- Proficiency in technical tools such as C/C++, ARM assembler, Java, Android debugger, Ghidra, IDA Pro, etc.
- Ability to configure and use LLMs for automating research tasks and generating proof-of-concepts, semi-functional, and functional exploits.
- Vulnerability research skills and knowledge of Kotlin and JavaScript will be an advantage.
- English language proficiency at the level of reading technical documentation.
- Professional experience and formal education are not important.
Browser Security Research
Responsibilities
- Perform tasks related to the security research of one of the popular browsers, assess vulnerabilities and proof-of-concept exploitability, write functional exploits, and chain exploits.
- Participate in the testing process of developed exploits, modify and update them with new software versions.
- Propose ideas to the team and participate in discussions on new developments and research.
Key Requirements
- Ability to learn quickly, analyze large amounts of scattered information and synthesize it into concrete knowledge, possess systemic thinking.
- Ability to work and make decisions under conditions of limited information, no fear of formulating hypotheses, testing them, and abandoning non-working ideas.
- Ability to focus on tasks that require a significant amount of time to solve, up to several months. Ability to maintain productivity and not give up when a task seems impossible.
Requirements
- Proven experience in writing exploits or finding critical vulnerabilities (Remote Code Execution, Privilege Escalation, Sandbox Escape, Mitigation Bypasses — RCE, LPE, SBX, mitigation bypasses) in one of the popular browsers (Chrome, Safari, Firefox, Samsung Internet, Edge) within the last year.
- Understanding of modern browser architecture, ability to work with one of the JavaScript engines (V8, WebKit, SpiderMonkey), JIT, DOM, WebAssembly, CSP, CORS.
- Knowledge of current browser vulnerability classes and protection mechanisms, such as PAC, JITCage, V8 Sandbox.
- Proficiency in technical tools such as C/C++, JavaScript, WASM, GDB, LLDB, WinDbg.
- Ability to configure and use LLMs for automating research tasks and generating proof-of-concepts, semi-functional, and functional exploits.
- Will be an advantage: vulnerability research skills in browsers, knowledge of Java and Objective-C languages, experience exploiting WebGL and ANGLE, experience with Frida, Valgrind, Angr, published browser exploitation research.
- English language proficiency at the level of reading technical documentation.
Conditions for all directions
- Salary from 1 million rubles per month depending on your qualifications and test task results, plus bonuses for each developed exploit.
- Fully remote work format and flexible schedule.
- Official employment according to the Labor Code of the Russian Federation.
- Professional development and career growth opportunities in one of the most technically complex areas of information security.
Send your resume to: contact@opzero.ru
