We are seeking a Vulnerability Researcher to join our 5G security team, focusing on protocol analysis and firmware reverse engineering. This role is for a practitioner with a strong systems background who is ready to take ownership of research tasks within complex telecommunications stacks. You will work as part of a high-performing group, identifying security flaws in 3GPP protocols and proprietary telecom binaries while developing the automated tooling necessary to secure national mobile infrastructure.

Responsibilities:

• Execute research into 3GPP protocols (NGAP, GTP, etc.) to identify crashes and logic flaws using stateful fuzzing techniques.

• Perform static and dynamic analysis on compiled telecom binaries and firmware to understand undocumented protocol logic.

• Support the development of custom Python3 scripts for protocol decoding and automating analysis of "closed-box" systems.

• Assist in mapping state machines within 5G session management flows using symbolic or concolic execution tools.

• Analyze signaling and data plane components to identify potential attack surfaces in 5G Core and RAN environments.

• Use debugging tools and packet analysis software (e.g., Wireshark) to inspect protocol traffic and hardware state.

• Document research findings and contribute to the development of technical security reports.

Qualifications:

Required:

• An active Top Secret clearance.

• 3–5 years of professional experience in software exploitation, reverse engineering, or protocol development.

• Strong proficiency in C/C++ and scripting experience in Python3.

• Working knowledge of 4G/5G architecture and networking protocols (TCP/IP, SCTP, HTTP/2).

• Experience with disassembly tools such as IDA Pro, Ghidra, or Binary Ninja.

• Foundational understanding of binary analysis and memory corruption primitives.

• Demonstrated ability to conduct independent technical research and analyze complex software systems.

Desired:

• An active SCI clearance.

• Experience with software-defined radio (SDR) or cellular testing equipment.

• Familiarity with Linux-based telecom network functions.

• Participation in security research projects or CTFs with a focus on networking or pwnable challenges.