Security Researcher - Vulnerability Management Content

We are looking for a Security Researcher to join our OVAL team and work on the development, validation, and maintenance of vulnerability-management content. The role involves researching publicly disclosed vulnerabilities, analyzing vendor security advisories, developing detection content, and validating the content against real-world software, operating systems, and product environments.

The ideal candidate should have strong hands-on experience with Oracle products and enterprise software environments, along with a good understanding of vulnerability management, software versions, patching, security advisories, and vulnerability detection. The candidate will also be responsible for reviewing existing content to ensure accuracy, completeness, and reliability.

Key Responsibilities

• Research and analyze CVEs, vendor security advisories, security bulletins, patches, and vulnerability disclosures.
• Analyze affected products, software versions, operating systems, packages, and platforms to determine vulnerability applicability and impact.
• Develop and maintain vulnerability detection content for vulnerability-management solutions based on vendor advisories and security intelligence.
• Develop detection logic for a wide range of enterprise products, with a particular focus on Oracle products and technologies.
• Perform hands-on testing of detection content across supported products, operating systems, versions, and configurations.
• Validate vulnerability content against real product installations and test environments to ensure accurate detection and minimize false positives and false negatives.
• Review existing vulnerability content for technical accuracy, version coverage, applicability, and consistency.
• Analyze vendor-provided remediation information, including patches, fixed versions, affected versions, and upgrade recommendations.
• Maintain product/version mappings and identify gaps in vulnerability coverage.
• Investigate and troubleshoot detection failures and discrepancies identified during validation.
• Collaborate with security researchers, vulnerability analysts, content developers, and QA teams to improve content quality.
• Document research findings, detection methodology, test cases, validation results, and implementation details.
• Contribute to the automation of vulnerability research, content generation, validation, and quality-assurance processes.
• Monitor emerging vulnerabilities, vendor security advisories, product releases, and changes in software packaging/versioning.
• Participate in peer reviews of vulnerability content and provide technical feedback to improve content quality and consistency.

Required Qualifications

• Bachelors degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 1+ years of experience in vulnerability management, vulnerability research, security content development, security testing, or a related cybersecurity domain.
• Hands-on experience working with Oracle products, including understanding Oracle product versions, patching mechanisms, security advisories, and Critical Patch Updates (CPUs).
• Experience working with multiple enterprise products, software platforms, and operating systems for vulnerability validation and testing.
• Strong understanding of CVEs, CWE, CVSS, vulnerability advisories, affected/fixed versions, and remediation concepts.
• Good understanding of software versioning, package management, product dependencies, and platform-specific differences.
• Hands-on experience with Linux operating systems and familiarity with Windows environments.
• Ability to install, configure, troubleshoot, and validate software/products in test environments.
• Experience developing or reviewing vulnerability detection rules/content or similar security content.
• Basic to intermediate scripting/programming skills, preferably Python, for automation and validation.
• Strong analytical and troubleshooting skills with the ability to investigate complex vulnerability and detection issues.
• Strong attention to detail, particularly when analyzing product versions, patches, configurations, and vendor documentation.
• Good written and verbal communication skills.

Preferred Qualifications

• Experience with Oracle Database, Oracle WebLogic, Oracle Java, Oracle Linux, and other Oracle enterprise products.
• Experience working with other enterprise products such as databases, application servers, middleware, web servers, virtualization platforms, and third-party applications.
• Experience interpreting Oracle Critical Patch Updates (CPU) and mapping vulnerabilities to affected product versions.
• Experience with vulnerability-management platforms or security-content frameworks.
• Familiarity with OVAL, SCAP, CPE, CVE, NVD, and related vulnerability-management standards.
• Experience building test environments using virtual machines or containers.
• Experience automating software installation, environment setup, vulnerability validation, or content testing.
• Familiarity with security tools and vulnerability scanners.
• Understanding of vendor patching and remediation processes.

What We Are Looking For

• Strong hands-on product-testing and validation experience.
• Ability to translate vendor security advisories into accurate and reliable vulnerability detection content.
• Ability to independently research unfamiliar products and technologies.
• Strong attention to detail when working with product versions, patches, configurations, and dependencies.
• A quality-focused mindset with an emphasis on detection accuracy, coverage, and maintainability.
• Willingness to work across a broad range of enterprise technologies and continuously learn new products.