Why collect a bug bounty when you can collect a full-time salary? Find bugs and vulnerabilities in products and systems to mitigate zero-day exploits and N-day attacks and help protect Australia’s most critical systems.

We’re seeking curious and creative minds with an interest or experience in Capture the Flag (CTF) events, Common Vulnerabilities and Exposures (CVEs), reverse engineering, or kernel deep dives to work on cutting-edge technologies and have a real impact in securing Australia.

The Role

ASD is seeking to fill multiple Vulnerability Research positions. In a strong team environment, you will work alongside equally talented colleagues supported by technical and non-technical mentors. You will play a crucial role in ensuring ASD’s vulnerability research capabilities are fit-for-purpose and responsive to sensitive and time-critical mission requirements.

As an ASD 4 or ASD 5 Vulnerability Researcher, your duties may include any of the following:

• Software reverse engineering, for example using decompilers such as Ghidra
• Inspecting packet captures to understand the behaviour of network protocols
• Writing code to detect vulnerabilities based on packet capture data
• Reviewing standards documentation to understand software and cryptographic protocols
• Writing code to emulate software or cryptographic protocols
• Writing code for a proof of concept to test a theoretical vulnerability
• Using a debugger to dynamically analyse software.

Please note: we do not expect candidates to be able to do all of these tasks. This list is provided to reflect the varied type of work candidates can expect to be involved in.

About our Team

We are looking for Vulnerability Researchers to join our Vulnerability Research and Cryptology teams. Both teams are nationally dispersed and our people have diverse skillsets, backgrounds and experience that they bring from industry, academia, and fresh from completing study.

We have a strong team culture which values technical and professional development, with a focus on collaboration, knowledge sharing, creativity and perseverance. We support flexible work practices (including part-time arrangements) so our people can balance their work and what is important to them outside of work.

We seek to recruit and develop a diverse workforce who are curious, imaginative and enjoy problem solving. These skills allow us to out-think and out-imagine some of the most testing adversaries and problems imaginable.

Vulnerability Research

ASD’s Vulnerability Research Section conducts vulnerability research and develops proof-of-concept exploits related to computer network security. The section researches capabilities to prevent network exploitation and deliver network effects.

Cryptology

ASD’s Cryptology Section is the Australian Government expert on cryptography and cryptanalysis. Cryptography is the study of making secure communication systems and cryptanalysis is the study of breaking secure communication systems.

Our Ideal Candidate

Successful Vulnerability Researchers come from a range of academic backgrounds and expertise.

ASD 4 Vulnerability Researcher

What is most critical is your aptitude and attitude. These are relatively early career positions, well suited to those who have recently graduated from university or those looking for a career change. We will provide comprehensive training and support to give you the knowledge necessary to succeed and progress as a Vulnerability Researcher. We want people who are:

• Curious and inquisitive
• Able to develop deep expertise in a particular topic
• Willing to learn from mistakes.

As an ASD 4, a demonstrated interest and aptitude in vulnerability research is more important than academic background or work experience.

ASD 5 Vulnerability Researcher

You will be operating more independently and be responsible for delivering outcomes with limited direction. We will continue to provide comprehensive training and support. We are looking for people who are:

• Curious and inquisitive
• Able to develop deep expertise in a particular topic
• Willing to learn from mistakes and share experience with those around you
• Able to operate with limited direction to achieve outcomes, drawing on your relevant technical skills and experience
• Able to proactively seek assistance and have informed discussions with subject matter experts

As an ASD 5, an academic background or work experience in any of the disciplines in the below list is desirable but not essential.

ASD is seeking applicants to fill current and anticipated vacancies and to create a merit pool for future vacancies. In line with the Australian Public Service Commissioner’s Direction 2022, upon completion of the recruitment activity, the merit pool will be available to locations across Australia.

Application Closing Date: Sunday 13th April, 2025

For further information please review the job information pack, reference ASD/02554/25 on www.asd.gov.au/careers.