Application Security Engineer – CVE & Vulnerability Research

About the role

Anyone AI is seeking experienced Application Security Engineers to join a focused project that validates real‑world software vulnerabilities, reproduces CVEs, assesses remediation, and verifies exploit mitigation. You will work with Docker‑based labs and security regression tests to ensure fixes are both effective and safe.

Key responsibilities

• Review CVE reproduction environments for technical accuracy and fidelity to original attack conditions.
• Validate that proposed security fixes address the root cause without breaking legitimate functionality.
• Develop and run exploit proof‑of‑concepts and verification scripts.
• Assess Docker and Docker‑Compose configurations for correct software versions, networking, and services.
• Identify incomplete fixes, alternative attack paths, and potential regressions introduced by patches.
• Provide clear, technically rigorous written feedback and recommendations.

Required profile

• 3+ years of hands‑on experience in application security, penetration testing, or vulnerability research.
• Strong knowledge of CVE, CVSS, CWE and common vulnerability classes.
• Experience with vulnerabilities such as SQL injection, command injection, SSRF, deserialization, buffer overflows, privilege escalation, access‑control issues, and security misconfigurations.
• Proficiency in secure coding practices and remediation strategies.
• Ability to evaluate exploit PoCs and determine if fixes truly mitigate risks.

Required skills

• Docker & Docker‑Compose
• Python (scripting and automation)
• Exploit verification tools (e.g., pwntools, curl, requests)
• CVSS, CWE classification
• Secure coding and vulnerability remediation techniques