Two Six Technologies
Vulnerability Research Analyst
$158K–$237K
Linthicum, Maryland +1 · Full-time · Posted Oct 15, 2026
- Location
- Linthicum, Maryland
Customer Site - Linthicum, MD - Experience
- Experience in vulnerability research, static source code analysis, reverse engineering, or software security audits; no number of years stated.
- Education
- Degree in Computer Science, Computer Engineering, Information Security, or equivalent practical experience.
About the job
Conducts software vulnerability research on extracted source code and binaries, evaluates AI-assisted detection tools, and assesses the root causes and exploitability of software flaws.
What you'll do
- Perform static and dynamic vulnerability analysis on source code repositories and firmware images.
- Use AI-guided fuzzing and automated detection tools, then validate findings by tracing code execution.
- Create detection rules and signatures, automate regression testing, and present risk assessments and metrics.
What they ask for
- Active US Security Clearance of Top Secret/SCI with polygraph; must be willing to obtain and maintain a Polygraph clearance.
- Degree in Computer Science, Computer Engineering, Information Security, or equivalent practical experience.
- Experience in vulnerability research, static source code analysis, reverse engineering, or software security audits.
- Understanding of memory management, pointer arithmetic, common software security flaws, and automated code analysis concepts.
Nice to have
- Experience authoring or tuning rules with CodeQL, Semgrep, or Tree-sitter parsers; firmware emulation experience.
- Experience with custom test harnesses, machine learning for bug discovery or code analysis, or DoD/IC vulnerability assessments.
Pay
$157,847 — $236,771 USD annualized base salary
Tools
CodeQL, Semgrep, Tree-sitter, QEMU, Unicorn Engine, Avatar2, Ghidra, IDA
AI focus
Deploy AI-guided fuzzing and automated vulnerability detection; familiarity with AI-driven automation tools and machine learning applications in automated bug discovery or AI-assisted code analysis.
Model-written summary · the original posting is authoritative