Cybersecurity RL Environment Reviewer - Offensive & AppSec

We’re building a dedicated bench of cybersecurity reviewers to QA our offensive-security and application-security RL environments: vulnerability-discovery tasks, vulnerability-patching tasks, and end-to-end exploit-construction tasks. You’ll work through environments we’ve already built - not build new ones - and tell us whether they’re fair, correct, and ready to ship.

This is part-time, flexible-hours part-time work. Most experts work a handful of hours per week; we’ll scope specific weekly workload with you directly.

What You’ll Do

• Review a codebase and a described vulnerability (e.g., SQLi, IDOR, SSRF, insecure deserialization, a memory-safety bug) and confirm it’s real, reachable, and findable by a skilled engineer using only the context provided - no outside information required.
• For patching tasks, confirm the grading actually fails while the exploit still works and passes only once it’s genuinely fixed - not just pattern-matching a diff.
• For exploit-construction tasks, trace or attempt the intended exploit path yourself to confirm it’s achievable within the given environment and constraints.
• Flag inconsistent files, missing context, unclear requirements, or anything that would make the task unsolvable or ambiguous for a model attempting it cold.
• Write a short, clear justification for every accept/reject/flag decision - this matters as much as the decision itself.

Internet Security, Internet Security, Testing, Artificial Intelligence (AI), Quality Assurance, Memory Hardware, Internet Application, Application Programming Interface (API), Penetration Testing, Applications Security, * Hands-on experience finding and validating real vulnerabilities in web applications, APIs, or backend services, through bug bounty, penetration testing, red teaming, or AppSec engineering.

• Comfortable reading unfamiliar code (any of Python, JS/TS, Java, Go, C/C++, Rust) well enough to trace a vulnerable data path, even without being a professional software engineer in that language.
• Able to clearly explain, in writing, why a vulnerability is or isn’t real and reachable - you’ll be judged on your justifications, not just your verdicts.
• Reliable and self-directed, comfortable working async with limited day-to-day oversight.

Nice to Have

• An active or past bug bounty track record (HackerOne, Bugcrowd, Synack, Intigriti) - leaderboard ranking, hall-of-fame mentions, or CVE credits are all useful signal.
• CTF experience (web or pwn categories), especially with a public CTFtime team ranking.
• A security certification such as OSCP, OSWE, OSCE, eJPT, eCPPT, or GWAPT.
• Prior experience specifically evaluating or grading other people’s security findings (triage, review, or mentorship work)., * $65-$100/hour - solid, demonstrable offensive-security experience (consistent bug bounty activity, 1+ years in an AppSec/pentest role, or a relevant certification) and the ability to independently verify straightforward discovery and patching tasks.
• $125-$250/hour - a recognized track record (top-tier bug bounty leaderboard placement, live-hacking-event invitations, advanced certifications such as OSWE/OSCE, or 5+ years of specialized offensive-security work), able to handle ambiguous or disputed calls and the hardest exploit-chaining tasks.

Exceptional, elite-tier reviewers (e.g., top-50 global bug bounty hunters) may be engaged above this range case-by-case for our highest-difficulty environments.

Hourly, part-time. Pay depends on experience and track record