Vulnerability Researcher
Bug hunting at scale, fuzzing, CVE drops, conference talks if you're lucky.
Top of the offensive ladder. Brutal entry, rewarding once you're in.
Read the full role verdict and reasoning
Vulnerability research develops reproducible findings within an authorised research scope.
- Domain
- Cybersecurity
- Entry
- Not mapped
- Senior
- Not mapped
- You've shipped public research, advisories or CVEs already
- You can read assembly and source in the same investigation
- You're prepared for months of work that may not produce a finding
- You're motivated by the work itself, the public credit is intermittent at best
- You've never reversed anything seriously outside coursework
- You need regular wins and external validation to stay motivated
- You expect bug bounty income to substitute for a salary, it usually won't
What "doing well" looks like in the seat
- Your findings are reproducible from your writeup alone
- Vendors take your disclosures seriously the first time
- You contribute to the toolchain other researchers use
- You can explain a vulnerability class clearly to a non-researcher
Investigation may end without a finding. Check disclosure expectations, review support and whether time is protected for root-cause analysis rather than only ticket throughput.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
High. Staff researcher comp at security product companies is excellent.
Who actually gets in
- +Pentester with depth
- +Malware analyst
- +Self-taught hacker
Common misconceptions
- −That bug bounty income is reliable, it isn't, for most.
Where this leads
- Offensive R&D
- Exploit Development
- Tooling Engineering
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Pathways that pass through here
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.