Exploit Developer
Weeks debugging a single primitive, bugs, mitigations, ROP, kernel internals.
Tiny, prestigious market (vendors, govs, top consultancies). Treat OSCP/OSEP as the floor, not the goal.
Read the full role verdict and reasoning
Exploit development investigates failure mechanisms and repeatable behaviour in authorised targets.
- Domain
- Cybersecurity
- Entry
- £34–45k
- Senior
- £60–80k
- You've already written working exploits outside coursework
- You enjoy reading vendor patches and reverse-engineering changes
- You can hold complex memory state in your head for hours
- You're motivated by the craft, public credit is rare
- You haven't shipped anything beyond a tutorial walkthrough yet
- You want regular hours and predictable wins
- You're chasing the prestige rather than the work
What "doing well" looks like in the seat
- Your exploits work reliably across patch revisions
- Vendors take your reports seriously without escalation
- You contribute to the toolchain other exploit developers use
- You can defend each step of your chain in writing
A reproducible crash is not proof of reliable exploitation. Clarify research scope, supported environments, disclosure and review of confidence claims.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
Senior exploit developer / vuln researcher; ceiling is depth, not breadth.
Who actually gets in
- +Reverse engineer
- +Vuln researcher
- +CTF / academic security
Common misconceptions
- −That exploit development is a normal pentest career path, almost no employer hires straight into it.
Where this leads
- Vuln Researcher
- Reverse Engineer
- Senior Red Team
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.