Cybersecurity Research Expert – Offensive Security & Vulnerability Research

$200–250/hrrate as listed

Review AI-generated vulnerability analyses, exploit chains, and security writeups for technical correctness and real exploitability, then document where the reasoning breaks down. Mercor screens for verifiable offensive security credentials — CVEs, top-tier CTF placements, accepted bug bounty findings, or published security research.

Summary, eligibility guidance and screening preparation are prepared by Sidequest from the platform's posting. Check the source listing before applying.

The work

You receive model outputs on non-trivial security problems: a root-cause analysis of a memory corruption bug, a proposed exploit chain against a hardened target, a triage verdict on a vulnerability report, a patch recommendation. Your job is to decide whether the reasoning actually holds — whether the primitive described is genuinely reachable, whether mitigations like ASLR, CFI, or sandboxing were accounted for, whether the "fix" closes the bug class or just the reported path. Plausible-sounding but wrong is the dominant failure mode, and catching it is the entire value of the role.

Beyond grading, contributors help build benchmark tasks: constructing scenarios with unambiguous ground truth, writing rubrics that distinguish a working exploit from a narrative about one, and flagging where the current evaluation scheme rewards confident prose over verified execution. Domains rotate across binary exploitation, Linux and Windows internals, browser security, web application security, cloud and container misconfiguration, cryptographic implementation flaws, and secure code review.

What the screen measures

Mercor's AI interview probes credentials for specificity, then follows up on depth. Expect to be asked which CVE you found, how you found it, what the primitive was, and what the vendor pushed back on — vague answers collapse quickly under a second question. Public artifacts matter here more than most categories: CVE IDs, CTF team and event placements, hall-of-fame listings, conference papers, or maintained tooling. Writing quality is also assessed directly, since the deliverable is written justification another researcher can audit.

Logistics

Fully remote and asynchronous; work is claimed from a queue rather than scheduled.
Most contributors commit 10–20 hours per week, with variable volume between project phases.
Observed rates for this listing run $200–250/hr, set per project and not guaranteed; final rate depends on screening outcome and task tier.
Expect a paid or unpaid calibration exercise before full task access, and periodic rubric updates as benchmarks evolve.

What they look for

Demonstrated vulnerability research output — CVEs, accepted bug bounty findings, or top-ranked CTF placements
Exploit development and mitigation bypass experience (ASLR, CFI, sandboxing, heap hardening)
Reverse engineering and binary analysis with IDA Pro, Ghidra, Binary Ninja, or Radare2
Systems-level programming in C/C++, Rust, Python, or Go
Clear technical writing — root-cause analyses and reviewable justifications
Working knowledge of fuzzing, symbolic execution, or static/dynamic analysis frameworks

Before you apply

Would you pass this screen?

Drawn from what this listing actually requires. Answered in your browser — nothing is sent to us, and we do not store your answers.

Have you been credited as the discoverer or co-author of at least one CVE affecting widely used open-source or commercial software?
CVE discoverer or co-author · required
Are you or have you been a member of a top-ranked Capture The Flag (CTF) team with demonstrated competitive achievements (e.g., top 50 or higher at major competitions)?
Top-ranked CTF team membership · preferred
Have you had vulnerability findings accepted by a major bug bounty program such as Google, Microsoft, Apple, Meta, GitHub, Mozilla, Chromium, Kubernetes, or Linux Foundation?
Bug bounty researcher credential · preferred
Have you authored or co-authored a peer-reviewed security research paper, conference presentation, or widely cited technical writeup?
Security research publication or conference presentation · preferred
Do you have professional experience in offensive security, vulnerability research, application security, or security engineering roles?
Offensive security professional experience · preferred
Do you have hands-on experience with exploit development, reverse engineering, or binary analysis work (using tools such as IDA Pro, Ghidra, Binary Ninja, or Radare2)?
Exploit development and reverse engineering skill · required

0 of 6 answered

Included with this listing

Interview prep — 10 questions

Matched to what this platform's screening actually measures. Answer each out loud in 60–90 seconds: claim → concrete example → implication.

What it tests: Whether you have genuine hands-on vulnerability research experience and can articulate the technical depth and methodology, not just claim credit.
A strong answer: Name a real CVE or family of related findings, explain the specific technical flaw (memory corruption, logic error, crypto weakness, etc.), describe the discovery method (fuzzing, code review, reverse engineering), and quantify impact or affected versions—showing you understand the vulnerability lifecycle end-to-end.
Where people lose it: Vague or secondhand account ('I helped review a CVE someone else found'), or inability to explain the root cause technically when pressed—signals you're inflating credentials or lack hands-on depth.