Vulnerability Researcher (Arlington)

The Company

Legion X is a cyber services company headquartered in Reston, VA that develops on-demand, custom cyber solutions through applied research, prototyping, and engineering services. We are a small, tight-knit company built and run by engineers who pursue the most interesting and impactful cyber vulnerability research we can find. We take on tasks like vulnerability assessments, exploit development, cyber vulnerability research, penetration tests, firmware reverse engineering, hardware reverse engineering, customized test rigs, capability development, and CNO support for both government and commercial customers. Our vision is to be the premier cyber vulnerability research and red team outfit in the nation.

We are a small, new company embracing what we believe to be the best and most efficient ways of working in the modern era of cybersecurity. That means freedom and flexibility but also responsibility. If you are self-motivated, battle tested, and driven by the passion of understanding a system so you can exploit it, then we encourage you to apply. We are looking for experts and excellent human beings we want to work with for a long time, and are willing to explore equity options for applicants so that the best come, stay, and win together.

The Role

(Hybrid with some commute to Northern Virginia is preferred, but fully remote is possible)

You are applying for the role of Vulnerability Researcher. The role is a technical individual performer with room for advancement as Legion X grows. That includes opportunities to specialize and promote as an individual performer or stay technical while building and leading teams. A Vulnerability Researcher is an experienced code exploiter that can turn a discovered vulnerability into a proof-of-concept on a wide variety of devices and software/firmware types. You must be a firmware/software reverse engineer who can analyze functionality of a binary with little to no help or outside input, and successfully identify, explain, and exploit discovered vulnerabilities. You must be able to document and explain your work to a non-technical audience. You must also be comfortable integrating your work into government systems in support of cyber operations or into commercial systems in support of systems hardening.

You will be expected to receive and execute tasks from engineering leads, analyze binary files that use a variety processor architectures (e.g. x86, ARM, PowerPC, etc.), use popular reverse engineering tools like Ghidra/IdaPro/etc., identify vulnerabilities in reverse engineered code (e.g. buffer overflows, weak protocol implementation, etc.), communicate the details of those vulnerabilities verbally and in writing, build proof-of-concept demonstrations of the vulnerabilities, and employ best practice techniques per customer requirements. You will be focused on firmware found in operational technology platforms like drones, planes, industrial facilities, cars, ships, and even weapon systems. However, we also contemplate work in networking devices, communications devices, endpoint systems, and IoT devices. For this position, you must be a US citizen who is TOP SECRET clearance eligible.

You will also be expected to remain flexible with the needs of a small business. That could include supporting penetration tests, drone assessments, operational technology risk analysis, and other tasks that are not purely vulnerability research in nature but still require an attacker mindset. You should enjoy having a variety of tasks over the course of a year.

In practical terms, if we gave you a computerized component of a car and a copy of the firmware binary running on it, could you identify and technically describe its cyber vulnerabilities? Could you build a tool that demonstrates one of those vulnerabilities?

Application Requirements

Before you apply, make sure you meet these requirements or you will be rejected:

• US Citizen with TOP SECRET clearance eligibility
• Experience and skillset aligned with the role (firmware reverse engineering experience and skills; cyber vulnerability research skills; protocol analysis skills; communication skills; self-motivation and drive; clear interest in the work)
• We do not have Certification or Degree requirements for this position -- your skill alone sets you apart
• Willingness to do at least one oral technical interview (1 hour long) over a virtual conferencing solution (like Zoom) in the period of 9am - 6pm Eastern. We can possibly accommodate other times if you ask.

There are also preferred skills that will strengthen your application:

• C/C++ programming experience
• CNO experience
• Hands-on hardware experience
• RF experience
• Firmware programming experience

There are also preferred conditions that will strengthen your application:

Local residence and willingness to commute to Reston, VA and Fairfax, VA as needed for hands-on work (we can discuss employee relocation to the area if willing)

Experience with government cyber capability development

Understand that the best applicants will be both strong technical and strong cultural fits.

Compensation

We are a small company yet we strive to compensate every employee as best we can. We manage to offer low-to-no deductible healthcare, competitive salaries, equity options, profit-sharing options, retirement benefits, fitness/gym benefits, a hardware/home office stipend, security clearances, holidays, PTO, and a firm belief in work-life balance. We also accept good ideas and are open to hearing exactly what compensates you best.

Non-Discrimination

We will not discriminate based on race, color, religion, sex (including pregnancy, sexual orientation, or gender identity), national origin, disability, age or genetic information (including family medical history) per federal law and our beliefs as a company. We base our hiring decisions on if you are the best fit for the job and customer requirements. But don't expect everyone to agree with your values when you arrive -- we expect that the best employees will come from a variety of different backgrounds and identities, but share one goal. We don't believe it is our company's job to tell you who you are or what you should value, but we do hope Legion X can be a place where you are open to share exactly who you are and what you believe, yet still find a team of other excellent people ready to work alongside you and get to know you better.