below marketmost similar roles pay hereabove market
This listing doesn't post a salary. Most similar roles pay
$144,812–$208,943.
Based on 240 similar postings.
Employer
About JPMorgan Chase
JPMorgan Chase & Co. is a global financial services firm and one of the largest banks in the world, offering investment banking, commercial banking, asset management, and consumer financial services.
JPMorgan Chase currently has
1226 open roles
on FindRole.
Listed pay typically runs
$156,750–$215,000
across 5 roles with salary data.
As an X-Day Offensive Research (XOR) Vulnerability Researcher within the Cybersecurity & Technology Controls line of business, you will enhance the firm's cybersecurity and resiliency posture. You will design and execute risk-driven assessments, including penetration tests, cyber exercises, and resiliency simulations to identify vulnerabilities in people, processes, and technology. Your daily work involves conducting in-depth vulnerability research and exploit development across operating systems, mobile devices, web applications, and enterprise software. You will utilize tools like IDA Pro, Ghidra, Binary Ninja, WinDbg, and GDB for reverse engineering, while employing fuzzers, symbolic execution, and dynamic binary instrumentation. You must perform patch diffing and exploit validation to uncover root causes. This role solves complex security problems by identifying systemic risks and providing remediation recommendations within the financial services sector.
Design and execute penetration tests, technical controls assessments, and cyber resiliency simulations.
Conduct in-depth vulnerability research and exploit development across operating systems, mobile devices, and web applications.
Reverse engineer binaries using tools like IDA Pro and Ghidra to identify novel attack surfaces.
Perform N-day vulnerability analysis, patch diffing, and proof-of-concept exploit validation.
Use fuzzers, disassemblers, and debuggers for static and dynamic analysis of software.
Evaluate control effectiveness for operational risk and identify opportunities for automated evaluation.
Develop comprehensive reports including risk assessments, remediation recommendations, and indicators of compromise.
Document research findings and technical workflows to ensure knowledge sharing and repeatability.
What we're looking for
5+ years of experience in cybersecurity or resiliency with demonstrated organizational skills to plan and coordinate offensive security testing.
Track record of discovered vulnerabilities (CVEs) in operating systems, mobile devices, web applications, browsers, edge devices, or enterprise software.
Proven hands-on experience in vulnerability research, proof-of-concept exploit development, coordinated vulnerability disclosure, and mitigating open-source security vulnerabilities.
Expertise in advanced analysis frameworks leveraging symbolic execution techniques and dynamic binary instrumentation to identify and exploit complex software vulnerabilities.
Hands-on proficiency exploiting complex vulnerability classes like use-after-free and double free using heap spraying and controlled memory corruption.
Strong understanding of the internals of at least two operating systems throughout user mode and kernel mode.
Extensive reverse engineering expertise on x86/x64 and ARM/ARM64 binaries using tools like IDA Pro, Ghidra, Binary Ninja, WinDbg, GDB, and RR.
Bachelor’s degree in computer science, PhD in a related technical field, or an equivalent combination of education and experience (preferred).
Vulnerability Research
Python
C
C++
Rust
Go
Reverse Engineering
Fuzzing
Embedded Linux
Firmware
Binary Analysis
Dynamic Instrumentation
Ghidra
IDA Pro
Binary Ninja
QEMU
Frida
gdb
lldb
Hardware-in-the-loop
Symbolic Execution
Fault Injection
FPGA
SoC
Vulnerability Research
Binary Exploitation
C
C++
Python
Swift
Objective-C
Machine Learning
LLMs
IDA
Ghidra
reverse-engineering
Fuzzing
Secure Boot
iOS
macOS