{"id":3469522,"url":"https://alion.io/job/census-ios-vulnerability-researcher","title":"iOS Vulnerability Researcher","company":{"id":55596,"name":"CENSUS","domain":"census-labs.com","url":"https://alion.io/company/census-labs","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Breezy","truth_index":{"grade":"B","score":81,"open_postings":4,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Thessaloniki, Greece"],"countries":["GR"],"hiring_countries":["GR"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Binary Ninja","optional":false},{"name":"C++","optional":false},{"name":"Frida","optional":false},{"name":"Ghidra","optional":false},{"name":"IDA Pro","optional":false},{"name":"Objective-C","optional":false},{"name":"Python","optional":false},{"name":"Swift","optional":false},{"name":"Assembly","optional":true}],"status":"live","first_seen_at":"2026-10-29T14:25:58Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-10-30T05:35:18Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"CENSUS is an internationally acclaimed Cybersecurity services provider. We support the needs of multiple industries, providing IT and OT security assessment services to public and private organizations around the world, including international financial institutions and Fortune 500 companies. Powered by cutting-edge research, scientific analysis, and real-world engineering, we deliver unparalleled security assessment services for software, devices, infrastructure, and organizations. Learn more about CENSUS at census-labs.com.\nAbout the Role\nCENSUS is looking for a iOS Vulnerability Researcher to join our security research team, focused on vulnerability discovery and exploitation across the iOS userland attack surface.\nYou’ll spend your time reverse engineering proprietary Apple software, identifying security boundaries and interesting attack surfaces, developing fuzzers and instrumentation, and turning promising primitives into reliable vulnerability research.\nThis is a hands-on research role for someone who enjoys working close to the metal, understands Apple's ecosystem and is comfortable operating without complete documentation.\nResponsibilities\nReverse engineer iOS binaries and system frameworks on ARM64/ARM64e.\nIdentify and investigate previously unknown vulnerabilities in iOS userland components.\nAnalyze system daemons, XPC services, framework APIs, parsers, and other undocumented components of the iOS/macOS system.\nDevelop targeted fuzzers and harnesses.\nDevelop reliable proof-of-concepts and undocumented techniques in controlled research environments.\nResearch the practical impact of modern mitigations including PAC, MTE/MIE, sandboxing, hardened runtime protections, and related platform defenses.\nDevelop custom tooling for binary analysis, instrumentation, tracing, fuzzing, and vulnerability research.\nCollaborate with other researchers on projects.\nTechnical Requirements\nHands-on vulnerability research, reverse engineering, exploitation research, or closely related security research experience.\nStrong understanding of C/C++ fundamentals, memory corruption, and common vulnerability classes.\nSolid ARM64/ARM64e assembly and calling-convention knowledge.\nPractical experience with reverse engineering using tools such as IDA Pro, Ghidra, Hopper, or Binary Ninja.\nExperience debugging with lldb.\nExperience performing crash analysis without a fully capable debugging environment.\nExperience with Frida, DTrace, custom instrumentation, or comparable dynamic-analysis tooling.\nAbility to write research tooling in Python and at least one systems language such as C, C++, Objective-C, Swift.\nUnderstanding of Objective-C & Swift runtime behavior and iOS process architecture.\nFamiliarity with fuzzing methodologies and experience building or adapting fuzzing harnesses.\nAbility to reason about the exploitability of a vulnerability rather than stopping at crash discovery.\nBeing able to adapt to scenarios where the complete technical picture is not present.\nPreferred Experience\nPrevious iOS or macOS vulnerability research.\nPublic vulnerability disclosures, CVEs, security advisories, conference talks, or substantial private research experience.\nFamiliarity with arm64e Apple specific internals\nFamiliarity with modern iOS exploitation mitigations.\nFamiliarity with jailbreak-era or modern iOS research tooling is useful, but not required.\nExperience adapting research techniques between iOS releases and dealing with\nundocumented platform changes.\nExperience with reversing Objective-C binaries.\nExperience with iOS/macOS IPC mechanisms, such as mach messages, MIG, and XPC\nWhat We Offer\nPlease note that some of the benefits listed below are applicable only to full-time employees in locations where CENSUS has a legal entity.\nThe chance to be part fast-growing, global cybersecurity company\nA collaborative, purpose-driven team with a strong learning mindset\nCompetitive salary and benefits, such as but not limited to:\nBirthday Paid Day off\nCoffee, lunch and office snacks free of charge\nPrivate Medical and Life Insurance covering employees & family members\nFunded certifications & postgraduate programs\nRecognition programs including welcome gift, new year celebration gift, referral bonus and long service vouchers\nExposure to international teams, leaders, and challenges\nOpportunities for professional growth, development, innovation, and more!\nApply today to start the conversation with People & Culture Team.\nCENSUS is an equal opportunity employer. The Company does not discriminate on the basis of race, color, creed, pregnancy, religion, gender, national origin, age, disability, marital, or any other legally protected status. The Company also makes reasonable accommodations for disabled employees. Finally, the Company prohibits the harassment of any individual based on their protected status. This policy applies to all areas of personnel actions including recruitment, hiring, training, promotion, compensation, benefits, transfer, and social and recreational programs.\nLI | Remote","description_format":"text","description_chars":5042,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance"],"hiring_locations":[{"name":"Greece","iso":"GR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Information Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-10-29T16:37:39Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":35,"reasons":["conf:0","win:early"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/census-ios-vulnerability-researcher","json_url":"https://alion.io/job/census-ios-vulnerability-researcher.json","meta":{"generated_at":"2026-10-30T06:50:19Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9663,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":55596},"rest":"https://alion.io/mcp/rest/get_company?id=55596"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcensus-ios-vulnerability-researcher"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcensus-ios-vulnerability-researcher"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcensus-ios-vulnerability-researcher"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/census-ios-vulnerability-researcher\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcensus-ios-vulnerability-researcher"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3469522}},{"tool":"search_jobs","arguments":{"company":"census-labs.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3469522},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}