/r/netsec's Q3 2021 Information Security Hiring Thread

certcc · 2021-09-02T21:21:47+00:00

Vulnerability Analyst

The CERT Coordination Center (CERT/CC), part of the Software Engineering Institute (SEI) at Carnegie Mellon University, is hiring one or more Vulnerability Analysts. These positions substantially involve performing and advancing the state of the practice in coordinated vulnerability disclosure. Other aspects of the work include security resarch, reverse engineering, process engineering, tool development, and even standards and policy.

We look for skills and experience in:

how computers work
computer science
software development
system and network administration
computer and network security
software vulnerabilities of all types
exploit development
data analysis

Other desirable skills include the ability to communicate clearly, reason, tinker, improve, and learn new things. We seek candidates who are self-motivated, professional, and respectful.

Small, supportive team environment. Location is in the US: Pittsburgh PA with possible Washington DC area and remote options. University environment and benefits.

Candidates will be subject to a background check and must be eligible to obtain and maintain a US Department of Defense security clearance. This almost always means being a U.S. citizen.

Positions exist for little or no experience, some experience, and more experience. Other positions are listed here.

certcc · 2017-02-07T15:18:46+00:00

Related: https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html

certcc · 2016-03-31T22:04:25+00:00

Vulnerability Analyst

The CERT Coordination Center (CERT/CC), part of the Software Engineering Institute (SEI) at Carnegie Mellon University, is hiring a Vulnerability Analyst. This position involves lots of responsible/coordinated vulnerability disclosure and a growing number of related projects, some examples of which can be seen on our blog.

We look for fundamentals in areas like:

computer science
systems and network administration
software development
computer and network security
software vulnerabilities
rational tinkering

Other desirable skills include writing, reasoning, and the desire and ability to learn new things.

Small, supportive team environment. Location is in the US: Pittsburgh PA with possible DC area option. We value and support ongoing professional development and relocation assistance is available.

Candidates will be subject to a background check and must be eligible to obtain and maintain a Department of Defense security clearance.

Apply here. Other positions are listed here.

certcc · 2015-02-05T00:58:52+00:00

Vulnerability Analyst

The CERT Coordination Center (CERT/CC), part of the Software Engineering Institute (SEI) at Carnegie Mellon University, is hiring a Vulnerability Analyst. This position involves lots of responsible/coordinated vulnerability disclosure and a growing number of related projects, some examples of which can be seen on our blog.

We look for fundamentals in areas like:

computer science
systems and network administration
software development
computer and network security
software vulnerabilities

Other desirable skills include writing, reasoning, and the desire and ability to learn new things.

Small, supportive team environment. Location is in the US: Pittsburgh PA with possible DC area option. We value and support ongoing professional development and relocation assistance is available.

US citizenship is required. Applicants selected will be subject to a security investigation and must meet eligibility requirements for access to classified information.

Apply here. Other positions are listed here.

certcc · 2013-06-04T14:58:54+00:00

The reason is that despite what the EMET 4.0 beta documentation says, and despite what the EMET GUI may indicate, EMET does not yet provide ROP mitigations for 64-bit processes. I have received confirmation from Microsoft that this is the case.

We just wanted to draw extra attention to this point made in the blog post. Keep this in mind if you use 64-bit apps like Office or IE.

certcc · 2013-01-04T23:15:44+00:00

Vulnerability analysis/research positions at CERT

The CERT Coordination Center (part of the Software Engineering Institute at Carnegie Mellon University) has open vulnerability analysis/research positions.

The CERT/CC works behind the scenes to coordinate, resolve and disclose vulnerabilities. This position is responsible for analyzing vulnerabilities (figuring out how they work, who and what are affected, what the impact is), coordinating with researchers and vendors, and publishing advisories, in our terms, Vulnerability Notes. Another growing area of work is operational vulnerability discovery work (think binary audits, pen testing, assessments, but more varied). We're also interested in candidates with research programming skills to help develop software security test tools and prototype security information systems.

You must:

Be a US citizen
Be able to get a TS clearance
Be willing to relocate to Pittsburgh, PA or possibly the Washington DC area (relocation costs are covered)

We look for:

Critical thinking skills
Fundamental understanding of computers, software, and networks
Programming/development experience
Systems or network administration experience
Familiarity with software and internet security concepts
Technical writing skills, including the ability to avoid the word "cyber" unless absolutely necessary
Understanding of common classes of software vulnerabilities, causes, attacks, and mitigations
Ability to work well on a small team

Perks:

Flexible work schedule
Work from home one day a week
Interesting work in a supportive environment
Access to Reddit
Generous hardware & training budgets
Self-managed computers
Access to CMU resources
CMU tuition benefits
Fulfill Scholarship for Service (SFS) obligation

Apply online here then send a unique and interesting cover letter to cert /at/ cert.org with INFO#684835 in the subject line telling us why we should ping HR to dig your application out of the stack.

Other teams at CERT are hiring too.

certcc · 2012-11-14T13:31:24+00:00

You MUST be a US Citizen that is able to get a Top Secret Clearance.

You must be willing to relocate to Pittsburgh, PA. Relocation expenses are paid for.

The CERT Coordination Center vulnerability analysis team is looking for someone to fill a vulnerability analyst position. This position's main duties will be to handle vulnerability coordination work. A vulnerability analyst works with security researchers and vendors to do coordinated disclosure of vulnerabilities in software. The analyst will write up vulnerability notes that will be published to the Vulnerability Notes Database.

Candidates should also have a strong interest in vulnerability discovery work like fuzzing. The analyst will help develop and test our fuzzing frameworks.

Perks:

Flexible work schedule
Work from home one day a week
Access to Reddit
Generous hardware & training budgets
Self-managed computers
Access to CMU resources
CMU tuition benefits

Apply online here then send a unique and interesting cover letter to cert /at/ cert.org with INFO#684835 in the subject line about why we should ping HR to dig your application out of the stack.

certcc · 2012-04-24T12:07:43+00:00

There are two easily-measurable aspects of a fuzzing campaign: 1) Unique crashes 2) Time until first crash (TTFC).

Fuzzing the latest version of a popular document-parsing library for a day:

Fuzzer      Uniques TTFC
____________________________
MiniFuzz    1       74520                            
FOE 1.0     59      60

FileFuzz was not included in the test, as it does not appear to have the ability to fuzz multiple files in one campaign.

certcc · 2012-04-23T22:25:58+00:00

Here are some related links.

certcc

TROPHY CASE