A specialist role, deliberately separate from the consultant profiles. You do not have to be the best web pentester in the company. This profile exists for the work where, after three hours in Ghidra, the interesting part is only just beginning.

You take things apart that nobody documented: firmware images, binaries, parsers, protocols. You find the vulnerability, you prove it, and you explain it so precisely that an engineering team can fix the actual cause.

What you will work on

Deep binary reverse engineering of firmware and product components.
Vulnerability research: finding, understanding, root-causing, not just crashing.
PoC development that demonstrates real impact in the product context.
Fuzzing: parsers, protocol implementations, file formats, built, triaged and driven by you.
Patch diffing and component analysis across versions and vendors.
Your own tools and scripts, the ones that make the next analysis faster.
Published research: advisories, technical write-ups, tools, conference material.

What you must bring

Excellent binary reverse engineering skills.
Assembly. ARM/AArch64, ideally x86 as well.
Ghidra or IDA, debugging.
Fuzzing and vulnerability research experience.
Root-cause analysis and PoC development.
Parser and protocol analysis.
Your own tools and scripts.

Ideally

Exploit development.
Embedded targets, kernel or RTOS internals.
Patch diffing.
Hardware interfaces.
C/C++.
Published research: CVEs, tools, CTF or RE work that speaks for itself.

What you will learn with us

Coordinated disclosure end to end, including the parts with manufacturers and regulators.
Hardware attack techniques beyond the debugger: glitching, side channels.
Turning research into evidence that holds up in product contexts.

Do not apply if …

… you stop at the crash. Root cause or it did not happen.
… you want to publish before you understood.
… you expect someone else to write up your findings.

Honestly

Research means dead ends. Days where nothing works are part of the job, and they count.
Client travel is the exception; most targets ship to you or to the Mannheim lab.
Small team: your research direction is real, but so is your responsibility for it.

What we offer

Research time is working time, publications and tools included.
Real targets: firmware and products that are actually deployed in the field.
Permanent position, flexible hours, remote-first with lab days in Mannheim.
No sales targets, no utilization theater, your output is research that holds up.

Links to publications, tools, CVEs or a CTF profile belong in the application. CV via the form, the work samples carry the weight. Not a 100% fit? Apply anyway.