This listing doesn't post a salary. Most similar roles pay
$144,750–$214,000.
Based on 239 similar postings.
Employer
About JPMorgan Chase
JPMorgan Chase & Co. is a global financial services firm and one of the largest banks in the world, offering investment banking, commercial banking, asset management, and consumer financial services.
JPMorgan Chase currently has
1117 open roles
on FindRole.
Listed pay typically runs
$186,160–$215,000
across 7 roles with salary data.
As an X-Day Offensive Research (XOR) Vulnerability Researcher within the Cybersecurity & Technology Controls line of business, you will proactively identify risks and vulnerabilities in people, processes, and technology. You will design and execute risk-driven assessments, including penetration tests, cyber exercises, and resiliency simulations to improve security posture. Your daily work involves conducting in-depth vulnerability research and exploit development across operating systems, mobile devices, web applications, and enterprise software. You will perform reverse engineering using IDA Pro, Ghidra, or Binary Ninja, utilize fuzzers like AFL++ and Syzkaller, and employ program analysis tools such as Angr and Frida. The role focuses on solving complex security challenges by analyzing memory-safety issues, performing patch diffing, and developing proof-of-concept exploits to address systemic risks within the financial services sector while ensuring compliance with regulatory requirements.
Design and execute penetration tests, cyber exercises, and resiliency simulations to identify risks in people, processes, and technology.
Conduct in-depth vulnerability research and exploit development across operating systems, mobile devices, web applications, and enterprise software.
Reverse engineer binaries using tools like IDA Pro or Ghidra to identify novel attack surfaces and develop proof-of-concept exploits.
Perform N-day vulnerability analysis, patch diffing, and validation of proof-of-concept exploits.
Utilize fuzzers, disassemblers, and debuggers for static and dynamic analysis of complex software vulnerabilities.
Evaluate the effectiveness of security controls and identify opportunities to automate control evaluations.
Produce comprehensive reports including risk assessments, remediation recommendations, and indicators of compromise for cross-functional teams.
Document research findings and technical workflows to ensure knowledge sharing and repeatability across the organization.
What we're looking for
5+ years of experience in cybersecurity or resiliency with skills to plan and coordinate offensive security testing.
Track record of discovered vulnerabilities (CVEs) in operating systems, mobile devices, web applications, browsers, edge devices, or enterprise software.
Proven hands-on experience in vulnerability research, proof-of-concept exploit development, and coordinated vulnerability disclosure.
Expertise in advanced analysis frameworks using symbolic execution and dynamic binary instrumentation to identify and exploit complex vulnerabilities.
Proficiency exploiting complex vulnerability classes like use-after-free and type confusion using heap spraying and controlled memory corruption.
Strong understanding of the internals of at least two operating systems across user and kernel modes.
Experience auditing large C/C++, Java, and .NET codebases to uncover memory-safety, injection, and deserialization vulnerabilities.
Extensive reverse engineering expertise on x86/x64 and ARM/ARM64 binaries using tools like IDA Pro, Ghidra, Binary Ninja, WinDbg, GDB, and RR.
C
C++
Python
Reverse Engineering
IDA Pro
Ghidra
Embedded Systems
Side-channel Analysis
Fault Injection
Differential Power Analysis
Correlation Power Analysis
Electromagnetic Analysis
Glitching
Oscilloscopes
Logic Analyzers
JTAG
i2C
FPGA
Cryptography
Signals Processing
Vulnerability Research
Binary Exploitation
Firmware
reverse-engineering
C
C++
Python
Swift
Objective-C
Machine Learning
IDA
Ghidra
Fuzzing
Secure Boot
Memory Corruption
iOS
macOS