Senior Browser Security Researcher

Remote, salary from 1M RUB, Operation Zero. Senior browser security researcher to find vulnerabilities and develop exploits.

Responsibilities: • Perform security research on a popular browser, verify existing vulnerabilities and proof-of-concepts for exploitability, write working exploits, chain exploits together. • Participate in testing of ready exploits, modify and update them with new software releases. • Propose ideas and participate in discussions on new developments and research.

Requirements: • Proven experience writing exploits or finding critical vulnerabilities (RCE, LPE, SBX, mitigation bypasses) in a popular browser (Chrome, Safari, Firefox, Samsung Internet, Edge) within the last year. • Understanding of modern browser architecture, ability to work with one of JavaScript engines (V8, WebKit, SpiderMonkey), JIT, DOM, WebAssembly, CSP, CORS. • Knowledge of current vulnerability classes and browser defense mechanisms such as PAC, JITCage, V8 Sandbox. • Proficiency in technical tools such as C/C++, JavaScript, WASM, GDB, LLDB, WinDbg. • Ability to set up and use LLMs for automating research tasks and generating proof-of-concepts, semi-working and working exploits. • Advantage: ability to find browser vulnerabilities, knowledge of Java and Objective-C, experience with WebGL and ANGLE, experience with Frida, Valgrind, Angr, published browser exploitation research. • English at the level of reading technical documentation.

Salary: from 1M RUB. Location: Remote.