Trenchant
Android Kernel - Exploit Developer
- Compensation
- Not disclosed
- Location
- Global
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- Not specified
- Category
- Mobile
- Posted
Skills
Must have
- - A substantial record of delivering working Android or Linux kernel exploits — not only finding bugs or producing crashes.
- - Expert knowledge of kernel memory management, object lifetimes, concurrency, locking, scheduling and common driver architectures.
- - Advanced SLUB and kernel-heap exploitation experience, including modern cross-cache or page-level techniques.
- - Strong ARM64 reverse engineering and debugging skills across source-available and partially proprietary components.
- - Practical knowledge of Android GKI, vendor modules, Binder, SELinux and mobile driver attack surfaces.
- - Deep familiarity with KASLR, PAN/PXN, CFI, PAC/BTI where relevant, hardened usercopy, refcount hardening and memory-tagging constraints.
- - The discipline to turn probabilistic exploitation into maintainable, testable delivery.
- Strong signals
- - Exploits delivered across several Android OEMs, SoCs or kernel families.
- - Original exploitation techniques demonstrated through published research or production-grade exploit delivery.
- - Experience with Binder, GPU, multimedia, networking, filesystem, DMA-BUF or OEM driver targets.
- - Kernel fuzzing, crash triage, patch analysis and rapid exploitability assessment.
- - A history of solving difficult stabilisation and mitigation-bypass problems for other senior engineers.
- How we work
- - Fully remote, with high autonomy and direct collaboration with vulnerability researchers and exploit developers.
- - We care about reliable capability and reproducible engineering, not flashy one-off demos.
- - N-day experience is valuable when it demonstrates advanced adaptation and exploitation depth. Public credits are welcome but not required.
Full description
We are hiring an exploit developer who has already shipped Android or Linux kernel exploits that work outside a laboratory-perfect setup.
This is a senior individual-contributor role for someone who can take a weak or unstable primitive, model the allocator and concurrency behaviour around it, work through modern mitigations and deliver a robust exploit with clear assumptions and failure modes.
What you’ll work on
- Zero-day and N-day Android kernel vulnerabilities across vendor kernels and device-specific drivers.
- Use-after-free, out-of-bounds access, reference-counting flaws, races, type confusion and logic vulnerabilities.
- Allocator shaping, object replacement, cross-cache techniques, page reuse, reclaim strategies and controlled race amplification.
- Control-flow-independent and data-only exploitation where traditional hijacking is not the best path.
- Target adaptation across kernel branches, Android releases, OEM configurations, SoCs and patch levels.
- Integration with browser and userspace researchers on complete exploit chains.
What you’ll deliver
- Reliable local-privilege-escalation or kernel-code-execution exploit components for modern Android targets.
- Reusable primitives for information disclosure, controlled read/write, object overlap, credential manipulation or equivalent goals.
- Target-aware exploit packages with setup, fingerprinting, diagnostics, cleanup and regression coverage.
- Explicit reliability data, environmental assumptions and known failure modes.
- New techniques for hardened kernels, unstable races or constrained vendor attack surfaces.
What we’re looking for
- A substantial record of delivering working Android or Linux kernel exploits — not only finding bugs or producing crashes.
- Expert knowledge of kernel memory management, object lifetimes, concurrency, locking, scheduling and common driver architectures.
- Advanced SLUB and kernel-heap exploitation experience, including modern cross-cache or page-level techniques.
- Strong ARM64 reverse engineering and debugging skills across source-available and partially proprietary components.
- Practical knowledge of Android GKI, vendor modules, Binder, SELinux and mobile driver attack surfaces.
- Deep familiarity with KASLR, PAN/PXN, CFI, PAC/BTI where relevant, hardened usercopy, refcount hardening and memory-tagging constraints.
- The discipline to turn probabilistic exploitation into maintainable, testable delivery.