MercorCybersecurity
CVE Vulnerability Expert
up to $90/hr
About this role, in Mercor's words
Evaluate the quality, fidelity, and completeness of vulnerability-reproduction and remediation tasks used to train and evaluate a frontier AI lab's models. You'll assess whether CVE reproductions are faithful, fixes are sound, verification logic is rigorous, and Docker-based lab environments accurately recreate exploitable conditions — and provide clear, rubric-based written feedback.
Candidate background
Basic Qualifications
- 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
- Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC)
- Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, privilege escalation)
- Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests)
- Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments
Preferred Qualifications
Show all 4 itemsHide these 4 items in Preferred Qualifications
- OSCP, GPEN, GWAPT, or equivalent offensive-security certification
- Experience with CVE disclosure, responsible vulnerability reporting, or maintaining exploit proof-of-concept code
- Background in DevSecOps, CI/CD security gating, or SAST/DAST tooling
- Prior technical content review, assessment design, or QA for security-focused engineering tasks
Quoted from selected sections of Mercor's posting. The full posting may state other conditions. Read the full posting
A closer look
More context, when you need it.
Full job descriptionThe original posting, in Mercor's words
Posted by Mercor, reproduced here so you can judge the role before clicking. Original posting ↗
Evaluate the quality, fidelity, and completeness of vulnerability-reproduction and remediation tasks used to train and evaluate a frontier AI lab's models. You'll assess whether CVE reproductions are faithful, fixes are sound, verification logic is rigorous, and Docker-based lab environments accurately recreate exploitable conditions — and provide clear, rubric-based written feedback.
Basic Qualifications
• 3+ years of hands-on experience in application security, penetration testing, or vulnerability research
• Strong understanding of CVE vulnerability taxonomy and severity frameworks (CVSS, CWE, CAPEC)
• Demonstrated expertise in secure coding and remediation across common vulnerability classes (SQL injection, command injection, buffer overflow, deserialization, SSRF, misconfigurations, privilege escalation)
• Experience designing or evaluating two-part verification logic (functionality tests + vulnerability tests)
• Proficiency with Docker and Docker Compose for multi-container vulnerability reproduction environments
Preferred Qualifications
• OSCP, GPEN, GWAPT, or equivalent offensive-security certification
• Experience with CVE disclosure, responsible vulnerability reporting, or maintaining exploit proof-of-concept code
• Background in DevSecOps, CI/CD security gating, or SAST/DAST tooling
• Prior technical content review, assessment design, or QA for security-focused engineering tasks
Working with MercorPay, getting started and work, from Mercor's own pages
What the platform publishes in general. These are not extra terms confirmed for this particular role.
- Getting paid
- Hourly work is paid every Wednesday for the previous week, through Stripe Connect or Wise, whichever Mercor assigns to your region. Stripe holds the first payout for 7 days. talent.docs.mercor.com/how-to/payments, talent.docs.mercor.com/policies/contracts
- Before your first paid task
- An AI interview of about 20 minutes, reused for other roles that need it, then any assessments the role asks for. Before logging hours: ID verification through Persona, a tax form, the contract documents, the Insightful time tracker, and a background check the onboarding guide says usually takes one to two weeks. talent.docs.mercor.com/support/ai-interview, talent.docs.mercor.com/how-to/apply, talent.docs.mercor.com/policies/contracts, talent.docs.mercor.com/how-to/id-verification, talent.docs.mercor.com/working/project-onboarding
- How much work
- Hearing back after the AI interview usually takes 2 to 4 weeks. When a project ends you are not moved to a new one automatically. talent.docs.mercor.com/support/ai-interview, talent.docs.mercor.com/support/project
- Contract
- Independent contractor with Mercor.io Corporation of San Francisco, which deducts no taxes. talent.docs.mercor.com/policies/taxes-work-authorization, talent.docs.mercor.com/support/legal
Read on the pages linked above on 23 Sep 2026. Platforms change these terms, so check the linked page before you rely on one.
Alex's experience on MercorA personal account, not a promise about your project
Alexruns this site and has worked on Mercor himself. Written 31 Aug 2026.
- Every interview I took used an AI interviewer. They always checked my microphone and camera and asked me to share my screen, and some included a timed exercise of around 25 minutes.
- Many later applications needed no new interview from me. With the required assessments complete and no other outstanding steps, applying could be close to one click.
- The application I checked did not ask for a rate. My offer matched my minimum in Work Preferences. That does not establish that Mercor always caps higher offers at your preference.
- Onboarding and setup came to about 4 hours, with more security and tool setup. Of the three platforms I worked on, it was the most complicated for me. That is an estimate from my projects, not a platform average.
- Mercor required the Insightful tracker on my project. I observed app and website usage monitoring, and I am unsure which screenshot settings applied, so check the configuration.
- I was paid for hours logged, once every 14 days, and I have not experienced late or incorrect payments. That was my arrangement. Mercor's current documentation describes weekly payout cycles, so check your own offer.
One person's applications, not a promise about yours.
What happens after you apply, first-handHow does the pay compare?Across Cybersecurity roles, not this role alone
From our own daily reads of every open listing on the platforms we follow, not from Mercor's posting. How we count.
Pay across the field: Cybersecurity
Across 54 roles in this field with a stated hourly rate in US dollars, on 10 platforms, the middle half pays $60 to $120 an hour at the top of the range, and the median is $95. This role's top rate, $90, is in the middle half. Of the 26 distinct rates we count, 12 are lower and 13 are higher.
| Platform | Roles | Top of range, per hour |
|---|---|---|
| Alignerr | 32 | $55 to $120 · median $60 |
| micro1 | 4 | $95 to $175 |
| AfterQuery | 4 | $75 to $135 |
| Mercor (this platform) | 3 | $95 to $250 |
| DataAnnotation | 3 | $125 |
Sources and listing historyWhere this information comes from
This listing's history
- First seen here on 26 Aug 2026, and still on Mercor's list when we last read it on 13 Oct 2026.
- Posted by Mercor
- First seen by AIPayList
- Last seen live
- Listing ID
- list_AAABoDrLTtVzOBh5_cNK5rFh
Pay as the source states it: “70–90 USD HOUR”.
Platforms sometimes change a rate after posting. Every listing here is re-read at least once a day and corrected when its source moves, so a difference you see on the platform is usually a change made since the last read. How freshness works.
Keep exploring
More like this
Related field, different requirements. Check each role's own page before you apply.