Anduril
Senior Vulnerability Engineer
$191K–$254K
Boston, Massachusetts, United States +5 · Senior · Full-time · Posted Sep 25, 2026
- Location
- Boston, Massachusetts, United States
Costa Mesa, California, United States
Washington, District of Columbia, United States
Boston, Massachusetts, United States
Costa Mesa, California, United States
Washington, District of Columbia, United States
About the job
Discover and validate novel vulnerabilities across software, firmware, embedded devices, protocols, and hardware/software boundaries, then produce reproducible technical findings and support remediation.
What you'll do
- Plan and conduct vulnerability research using methods such as code review, reverse engineering, fuzzing, dynamic instrumentation, hardware analysis, and adversarial testing.
- Develop research tooling and hardware-in-the-loop experiments; assess root cause, exploitability, impact, and mitigations.
- Collaborate on remediation and write technical reports with evidence, reproduction steps, assessments, and mitigations.
What they ask for
- Strong experience discovering vulnerabilities in firmware, applications, embedded systems, protocols, or hardware-adjacent systems.
- Proficiency in one or more of Python, C, C++, Rust, or Go; experience with vulnerability research techniques such as fuzzing, crash triage, exploitability analysis, code review, binary analysis, or dynamic instrumentation.
- Hands-on familiarity with Linux, embedded systems, networking, debugging, and common security research tooling.
- Must be eligible to obtain and maintain a U.S. security clearance.
Nice to have
- Experience with boot chains, firmware updates, device identity, cryptographic integrations, anti-tamper mechanisms, or programmable-logic-backed systems.
- Experience with advanced research techniques or tools such as coverage-guided fuzzing, symbolic execution, Ghidra, IDA Pro, QEMU, or Frida.
Pay
$191,000 — $254,000 USD (base salary)
Tools
Python, C, C++, Rust, Go, Linux, Ghidra, IDA Pro
Model-written summary · the original posting is authoritative