Android Kernel - Exploit Developer

We are hiring an exploit developer who has already shipped Android or Linux kernel exploits that work outside a laboratory-perfect setup.

This is a senior individual-contributor role for someone who can take a weak or unstable primitive, model the allocator and concurrency behaviour around it, work through modern mitigations and deliver a robust exploit with clear assumptions and failure modes.

What you’ll work on

- Zero-day and N-day Android kernel vulnerabilities across vendor kernels and device-specific drivers.

- Use-after-free, out-of-bounds access, reference-counting flaws, races, type confusion and logic vulnerabilities.

- Allocator shaping, object replacement, cross-cache techniques, page reuse, reclaim strategies and controlled race amplification.

- Control-flow-independent and data-only exploitation where traditional hijacking is not the best path.

- Target adaptation across kernel branches, Android releases, OEM configurations, SoCs and patch levels.

- Integration with browser and userspace researchers on complete exploit chains.

What you’ll deliver

- Reliable local-privilege-escalation or kernel-code-execution exploit components for modern Android targets.

- Reusable primitives for information disclosure, controlled read/write, object overlap, credential manipulation or equivalent goals.

- Target-aware exploit packages with setup, fingerprinting, diagnostics, cleanup and regression coverage.

- Explicit reliability data, environmental assumptions and known failure modes.

- New techniques for hardened kernels, unstable races or constrained vendor attack surfaces.

What we’re looking for

- A substantial record of delivering working Android or Linux kernel exploits — not only finding bugs or producing crashes.

- Expert knowledge of kernel memory management, object lifetimes, concurrency, locking, scheduling and common driver architectures.

- Advanced SLUB and kernel-heap exploitation experience, including modern cross-cache or page-level techniques.

- Strong ARM64 reverse engineering and debugging skills across source-available and partially proprietary components.

- Practical knowledge of Android GKI, vendor modules, Binder, SELinux and mobile driver attack surfaces.

- Deep familiarity with KASLR, PAN/PXN, CFI, PAC/BTI where relevant, hardened usercopy, refcount hardening and memory-tagging constraints.

- The discipline to turn probabilistic exploitation into maintainable, testable delivery.

Strong signals

- Exploits delivered across several Android OEMs, SoCs or kernel families.

- Original exploitation techniques demonstrated through published research or production-grade exploit delivery.

- Experience with Binder, GPU, multimedia, networking, filesystem, DMA-BUF or OEM driver targets.

- Kernel fuzzing, crash triage, patch analysis and rapid exploitability assessment.

- A history of solving difficult stabilisation and mitigation-bypass problems for other senior engineers.

How we work

- Fully remote, with high autonomy and direct collaboration with vulnerability researchers and exploit developers.

- We care about reliable capability and reproducible engineering, not flashy one-off demos.

- N-day experience is valuable when it demonstrates advanced adaptation and exploitation depth. Public credits are welcome but not required.