CVE Vulnerability Expert
About this role
Evaluate the quality, fidelity, and completeness of vulnerability-reproduction and remediation tasks used to train and evaluate a frontier AI lab's models. You'll assess whether CVE reproductions are faithful, fixes are sound, verification logic is rigorous, and Docker-based lab environments accurately recreate exploitable conditions, and provide clear, rubric-based written feedback.
Basic Qualifications
- 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
- Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC)
- Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, privilege escalation)
- Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests)
- Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments
Preferred Qualifications
- OSCP, GPEN, GWAPT, or equivalent offensive-security certification
- Experience with CVE disclosure, responsible vulnerability reporting, or maintaining exploit proof-of-concept code
- Background in DevSecOps, CI/CD security gating, or SAST/DAST tooling
- Prior technical content review, assessment design, or QA for security-focused engineering tasks
Details
- Pay: $70 to $90/hr
- Company: Mercor
- Location: Remote
- Eligible locations: United States
- Platform: Mercor
Frequently asked questions
How much does the CVE Vulnerability Expert role pay?
Mercor lists this CVE Vulnerability Expert position at $70 to $90/hr. Pay is set by Mercor and your exact offer depends on your experience and the scope of the work.
Is the CVE Vulnerability Expert role remote, and can I work from home?
Yes. Mercor lists this CVE Vulnerability Expert position as fully remote, so you can work from home or anywhere with a reliable computer and internet connection.
Is CVE Vulnerability Expert full time or part time?
Mercor lists this as a contractor remote role. Full details are in the role description above.
Which countries can apply for CVE Vulnerability Expert?
Mercor lists eligibility for United States. Check the Mercor listing for current requirements before applying.
Do I need experience to apply for CVE Vulnerability Expert?
The requirements are listed in the role description above. Mercor screens applicants through its own process, and relevant skills or credentials strengthen your application.
How do I apply for the CVE Vulnerability Expert role, and is it legit?
Use the apply button on this page to go straight to the official Mercor listing. Mercor is a real hiring marketplace and applying is free. No legitimate employer charges you to apply.
Stay Updated on Roles Like This
Subscribe to receive fresh openings aligned with AI Training & Evaluation and AI training roles across Mercor and JobHub by NeonLabs