Reverse Engineer / Vulnerability Researcher

Role overview Conduct deep security research on firmware, binaries, parsers, and protocols, taking findings from initial discovery through root-cause analysis and proof of impact. The work is focused on understanding vulnerabilities well enough to explain the underlying defect and help product engineers fix it, with scope for tools and publishable research.

Responsibilities - Reverse engineer firmware and product components, including undocumented binaries and parsers. - Find and investigate vulnerabilities, determine root causes, and develop proof-of-concept demonstrations grounded in product impact. - Build and run fuzzing efforts for parsers, protocols, and file formats, including triage of results. - Compare software versions and components to identify changes relevant to security. - Create scripts and tools that improve analysis, and communicate results through advisories, technical writing, or conference material.

Requirements - Strong binary reverse-engineering skills and assembly knowledge, especially ARM/AArch64; x86 experience is useful. - Experience with Ghidra or IDA and debugging workflows. - Practical vulnerability research and fuzzing experience. - Ability to perform root-cause analysis, develop PoCs, and analyze parsers and protocols. - Skill in writing tools or scripts to support research.

Nice to have - Exploit development, embedded targets, kernel or RTOS internals, patch diffing, hardware interfaces, or C/C++. - A record of relevant research, such as CVEs, tools, CTF work, or reverse-engineering projects.

Benefits and work setup - Permanent, remote-first position with flexible hours and lab days in Mannheim; most targets are shipped to researchers, and client travel is uncommon. - Dedicated work time for research, publications, and tools; access to real deployed products and senior-led reviews. - Budget for certifications and conferences, with no sales targets. The role includes learning coordinated disclosure and hardware attack methods such as glitching and side-channel analysis.