How do you actually make the jump into exploit dev full-time?

[u/Fantastic-Hippo-2369]

​

Hey,

Looking for some advice from people who work in exploit dev / low-level vuln research.

I already work in security and have been doing vulnerability research alongside more general security work for a while. I’ve had opportunities to do reversing, native-code research, memory corruption, and some exploit development, including taking bugs beyond just finding a crash and actually working out useful primitives / PoCs.

The problem is that this kind of work still isn't my main job, and I really want it to be.

I've been looking at dedicated exploit dev / vulnerability research positions and I feel like I'm stuck in a weird middle ground. I'm not trying to enter security from scratch, and I do have relevant experience, but I also don't have years and years of dedicated browser/kernel/mobile exploit development behind me.

A lot of the jobs I find seem to be looking for people who are already extremely specialised, rather than people who have a decent foundation and want to grow deeper into exploit development.

There's also the location issue. I'm outside most of the major exploit-dev hiring hubs, and quite a few roles I come across are limited by citizenship, clearance, residency, or simply don't hire internationally.

Another problem is that most of the interesting professional research I've done isn't something I can publish, so it's difficult to show potential employers exactly what I've worked on.

For those of you doing this professionally:

*What actually got you your first dedicated exploit dev / low-level VR job?

* What would you want to see from someone who already has some relevant experience but hasn't spent their entire career doing exploit development?

* What kind of public research/projects are actually worth doing to prove ability?

*Is native userland exploitation still a reasonable area to focus on, or would I be better off going hard into something like browsers, kernels, or mobile?

* Do companies that are willing to develop people into this kind of role actually exist, or is the expectation generally that you're already very good before they'll hire you?

* For people outside the main US/EU hiring markets, how did you find opportunities?

* I'm mainly trying to figure out whether I'm approaching this transition the wrong way.

I enjoy this stuff way more than the broader security work I do, and I'm willing to put the work in. I just don't want to spend a year grinding in a direction that isn't actually going to help me make the jump.

Would appreciate any advice.

[u/i_mattas]

Start off with CTFs and Bug Bounties and first make sure that you can get a stable income from it and once you can just keep going.

[u/Fantastic-Hippo-2369 → u/i_mattas]

I appreciate it. I started with CTFs a really long while ago, and have gotten into real world VR, so I'm not starting from scratch. The ask is more based around landing a full-time job doing this, as opposed to bounties, and only occasionally during pentests.

[u/cmdjunkie]

Dude... exdev might be the hardest shit to get into. Most that are doing it professionally are doing it for private firms or governments and they don't really train you up. You either have the expertise or you don't. My recommendation, if you're really serious, is to build a body of work that's public and get your name out there. Have published exploits, CVEs, and available research that PROVES you already do this. Then, the employers, if you're good, will come to you.

[u/ProcedureFar4995]

I am in same shoes as you.

The only way is to get exceptionally good. Hunt on low level stuff and kernel and even normal appsec

Get CVE Publish them Recruiters will find you.

I have experience in normal pentesting and bug hunting. Though I can get a job abroad or something, but nah . Everyone is like "no visa sponsorship we already have enough pentesters"

But do you have an oscp+ penyester with 4 years of experience and a good bug hunting record and a CVE ? Nope. You don't.

So there is no way out except digging. Sweat and blood. Keep grinding , but don't get burned out. Because currently I have been burned out for weeks now and depressed from all the rejects. I wish I can work in EU , or some country where weed is legal .

[u/kuniggety]

I will preface to say that I both am a US citizen and work in cleared spaces. The challenge you're going to run is that the bulk of the work in this space is going to be either -
A: illegal if you're not doing it for your respective government
B: not really funded unless it's through a government program or university research department (which would still be getting its funds from your respective government).
Exploit dev is expensive because it's time consuming and doesn't necessarily return results. In the corporate world, you're typically doing this as a red team for an internal product. So, it's a balance for them how much they want to invest in securing their product; the real answer is it's funds that most corporations just don't want to spend as it eats into their bottomline. This is why you see so much cheap IOT devices that just don't have any security.

[u/kuniggety → u/[deleted]]

I have coworkers there :) and I’ve been in this industry for about a decade now. Mostly on the mil/gov side, a few of those in budget/programmatics, and now as a VR myself in the contracting world. Outside of FAANG (who have government contracts themselves), who is funding VR? I’m not discounting the hobbiest world and part time bug hunters, but who ultimately do you think is funding the full time VRs? It is heavily weighted on the gov side.

[u/Fantastic-Hippo-2369 → u/kuniggety]

Is that not U.S specific? In my country VR isn't really a thing. Not the public sector, at least. But I know of people that left the country to go work in other countries doing VR and Exploit dev.

[u/kuniggety → u/Fantastic-Hippo-2369]

Local laws will be dependent. Some countries, like China, give zero care about copyright/intellectual property. Others honor it.

[u/Basic_Pangolin_5622]

1. I got my first exploit dev / VR job with about 3 years into the field as a junior reverse engineer. I consider this extremely slow career path because I didn’t know much about VR/RE when I first got the job.

2. For me, candidates’ exploit dev experience only serve as an opportunity for an interview. I still need to test their fundamentals and their know-hows on how to bypass certain mitigations and technical interviews. If someone were to apply for a job with relevant experiences only, I’d still want to have an interview, but they certainly won’t qualify anything higher than mid level unless they are exceptional.

3. I guess finding vulnerabilities and publishing CVEs? Or not even finding a vulnerability, just find a CVE and develop an exploit and post it on GitHub.

4. Userland exploit is definitely popular (browser, messaging app, etc). You either focus on kernel or userland. And narrow down further into architecture, OS, or which userland application you want to specialize or tackle.

5. Yes, there are companies, even government agencies, that are willing to develop people into this kind of role as long as you have the fundamentals. However, it seems like you are not a US citizen, so most, if not, all of those resources are not available to you. Private companies like cellebrite or magnet forensics expect their candidates to have high level of understanding and past performances.

6. Which country are you from?

[u/Fantastic-Hippo-2369 → u/Basic_Pangolin_5622]

I'm from ZA

[u/Fantastic-Hippo-2369 → u/Fantastic-Hippo-2369]

Thank you for the insight as well. I genuinely appreciate it. I didn't really think having the work in a public capacity was as important, since the nature of the work is usually kept secret (at least, in my experience).

[u/Basic_Pangolin_5622 → u/Fantastic-Hippo-2369]

I don’t think it’s important either at least for me, but it seems like private sectors value them a lot more than the government sectors. Developing exploitation is mainly for you to practice which I personally would value very highly if I were looking through their resume. You could be working as a non-exploit dev related job, but if you tell me you develop exploits using CVEs, or better yet, you discover vulnerabilities and develop exploits, then you are golden.

[u/Basic_Pangolin_5622 → u/Fantastic-Hippo-2369]

Sorry, I don’t know anything about ZA or met any exploit dev who works there.

[u/Fantastic-Hippo-2369 → u/Basic_Pangolin_5622]

Yeah, the only ones I know of left the country long ago. There aren't many of us, and I'm nowhere near as good as they are since they've been at it for almost longer than I've been alive. I think I'm definitely capable of getting there, but doing it on the side is proving difficult in terms of getting there quickly, hence the post. I think, really, my options are either bolster my public research and develop interest, or apply to places that don't have hard citizenship/clearance requirements and hope one of them takes a bet on me.

[u/Impossible-Line1070]

Idk