Vulnerability Research and Exploit Developer

About the role

CACI is hiring a Vulnerability Research and Exploit Developer (VRED) in Fort Meade, Maryland, to support DoD and interagency requirements by analyzing and exploiting mobile and network devices. The role works closely with interagency partners and integrates with Joint Cyber Operations Group (JCOG) personnel, with up to 10% local travel. The position requires a TS/SCI clearance with polygraph and is contingent on funding.

Key responsibilities

• Conduct vulnerability research and exploit development for mobile and network devices.
• Identify and analyze security weaknesses in complex systems and provide actionable solutions.
• Apply AI models and AI-assisted workflows (e.g., LLM-assisted code analysis, reverse engineering, triage) to speed up discovery and development.
• Collaborate with interagency partners and JCOG personnel to support mission objectives.
• Develop and maintain tools and scripts for automated vulnerability detection and exploitation.
• Integrate solutions into existing systems without disrupting operations.
• Provide technical guidance to team members and document research findings and exploit development.

Required profile

• Current TS/SCI clearance with polygraph.
• Bachelor's degree in Computer Science, Cybersecurity, Engineering or a related field, with at least five years of relevant experience, or an equivalent combination.
• Proven track record of identifying and exploiting weaknesses in mobile and network devices.
• Excellent written and verbal communication skills; able to work independently and in a team.

Required skills

• Programming in C/C++, Python and assembly (ARM/x86).
• Exploit development, reverse engineering and vulnerability assessment tools such as IDA Pro, Ghidra, Binary Ninja, Frida, GDB/LLDB and QEMU.
• Desired: OSCP, OSED/OSEE, GXPN, GREM certifications; fuzzing harnesses (AFL++, libFuzzer, honggfuzz); deep knowledge of memory-corruption vulnerabilities and mitigation bypass; reverse engineering of closed-source binaries and embedded firmware; iOS and Android internals; published CVEs, Pwn2Own, DEFCON/Black Hat talks or CTF results; kernel-mode exploitation and OS internals (XNU, Linux, Windows).

What we offer

• Proposed pay range of $131,800 - $290,000, depending on location, experience, skills and certifications.
• Healthcare, wellness, financial, retirement, family support, continuing education and time-off benefits.
• Flexible time off and learning resources.