We are hiring an exploit developer who has already shipped Android or Linux kernel exploits that work outside a laboratory-perfect setup.
This is a senior individual-contributor role for someone who can take a weak or unstable primitive, model the allocator and concurrency behaviour around it, work through modern mitigations and deliver a robust exploit with clear assumptions and failure modes.
What you’ll work on
- Zero-day and N-day Android kernel vulnerabilities across vendor kernels and device-specific drivers.
- Use-after-free, out-of-bounds access, reference-counting flaws, races, type confusion and logic vulnerabilities.
- Allocator shaping, object replacement, cross-cache techniques, page reuse, reclaim strategies and controlled race amplification.
- Control-flow-independent and data-only exploitation where traditional hijacking is not the best path.
- Target adaptation across kernel branches, Android releases, OEM configurations, SoCs and patch levels.
- Integration with browser and userspace researchers on complete exploit chains.
What you’ll deliver
- Reliable local-privilege-escalation or kernel-code-execution exploit components for modern Android targets.
- Reusable primitives for information disclosure, controlled read/write, object overlap, credential manipulation or equivalent goals.
- Target-aware exploit packages with setup, fingerprinting, diagnostics, cleanup and regression coverage.
- Explicit reliability data, environmental assumptions and known failure modes.
- New techniques for hardened kernels, unstable races or constrained vendor attack surfaces.
What we’re looking for
- A substantial record of delivering working Android or Linux kernel exploits — not only finding bugs or producing crashes.
- Expert knowledge of kernel memory management, object lifetimes, concurrency, locking, scheduling and common driver architectures.
- Advanced SLUB and kernel-heap exploitation experience, including modern cross-cache or page-level techniques.
- Strong ARM64 reverse engineering and debugging skills across source-available and partially proprietary components.
- Practical knowledge of Android GKI, vendor modules, Binder, SELinux and mobile driver attack surfaces.
- Deep familiarity with KASLR, PAN/PXN, CFI, PAC/BTI where relevant, hardened usercopy, refcount hardening and memory-tagging constraints.
- The discipline to turn probabilistic exploitation into maintainable, testable delivery.
Strong signals
- Exploits delivered across several Android OEMs, SoCs or kernel families.
- Original exploitation techniques demonstrated through published research or production-grade exploit delivery.
- Experience with Binder, GPU, multimedia, networking, filesystem, DMA-BUF or OEM driver targets.
- Kernel fuzzing, crash triage, patch analysis and rapid exploitability assessment.
- A history of solving difficult stabilisation and mitigation-bypass problems for other senior engineers.
How we work
- Fully remote, with high autonomy and direct collaboration with vulnerability researchers and exploit developers.
- We care about reliable capability and reproducible engineering, not flashy one-off demos.
- N-day experience is valuable when it demonstrates advanced adaptation and exploitation depth. Public credits are welcome but not required.
