Scientist -- Offensive Security & AI

Job Description

Security Researcher — Offensive Security & AI

Company: Hawksbill

Employment: Full-time

Location: Honolulu, Hawaii / remote eligibility

About the Role

Hawksbill develops offensive security capabilities that help organizations discover exploitable weaknesses, understand their consequences, and verify that defenses work. Our work combines vulnerability research, adversarial testing, and AI-driven automation across software, firmware, and connected systems.

We are seeking a Security Researcher to lead hands-on investigations and build capabilities that make offensive security research more effective and repeatable. You will take investigations from initial attack-surface analysis through vulnerability discovery, exploitability validation, and remediation verification. You will also help translate successful research techniques into reusable tools and AI-assisted workflows within Hawksbill’s Cyber Armory platform.

This role requires strong offensive security judgment, an ability to work through unfamiliar systems, and the engineering skills to turn research into dependable tooling.

Responsibilities

\n
• Conduct in-depth vulnerability research across software, firmware, and connected systems using source review, reverse engineering, fuzzing, and static and dynamic analysis.
\n
• Map attack surfaces, identify trust-boundary failures, and investigate how individual weaknesses can combine into practical attack paths.
\n
• Develop reliable proof-of-concept exploits and controlled demonstrations that establish root cause, exploitability, and operational impact.
\n
• Design and build automation that accelerates target analysis, vulnerability discovery, triage, validation, and retesting.
\n
• Integrate AI-assisted reasoning and agentic workflows with security tools, while independently verifying generated findings and exploit claims.
\n
• Own technical investigations from scoping through delivery, producing reproducible findings, clear evidence, and actionable remediation guidance.
\n
• Collaborate with partners and engineering teams to verify fixes and convert lessons from individual assessments into reusable platform capabilities.
\n
• Contribute to coordinated disclosures, technical publications, and the development of junior researchers, as appropriate.
\n

Minimum Qualifications

\n
• PhD in Computer Science, AI, Cyber and related fields
\n
• Demonstrated experience in offensive security, vulnerability research, reverse engineering, or exploit development.
\n
• Ability to independently investigate unfamiliar software or systems and distinguish exploitable vulnerabilities from unverified tool output.
\n
• Strong programming skills in Python and experience with C/C++, assembly, or other languages relevant to the targets you investigate.
\n
• Practical experience with debugging, program analysis, and security testing tools.
\n
• Experience producing reproducible proof-of-concept demonstrations and clear technical reports.
\n
• A degree in Computer Science, Cybersecurity, Computer Engineering, or a related field, or equivalent practical experience.
\n

Preferred Qualifications

\n
• A track record of original vulnerability discoveries, CVEs, security advisories, research publications, or substantive offensive security tooling.
\n
• Experience with firmware, embedded Linux, network protocols, medical devices, or industrial control systems.
\n
• Experience developing fuzzing harnesses, analysis pipelines, or automated exploitability validation.
\n
• Experience building AI-assisted security tools or agentic systems that interact with analysis and testing environments.
\n
• Participation in advanced CTFs, vulnerability research competitions, bug bounty programs, or comparable independent research.
\n
• Experience taking research prototypes into sustained operational use.
\n