Company Description: Curvia AI is a London, UK-based technology and AI solutions company that transforms complexity into opportunity through enterprise solutions, AI-powered automation, and data-driven insights. We build practical, scalable, and human-centered technology grounded in integrity, security, and responsible innovation. Role Overview We are seeking a Senior Software Security Engineer to develop high-quality training and evaluation tasks for frontier AI coding models. You will transform real-world open-source vulnerabilities—including CVEs, security advisories, and bug reports—into Harbor-format audit-and-patch tasks across multiple programming languages. This role combines software security research, vulnerability reproduction, benchmark development, automated testing, and technical review. Offer Details:
• Commitments Required: 8 hours per day with an overlap of 4 hours with PST.
• Employment type: Contractor assignment (no medical/paid leave)
• Contract Length: Short Term Contract (3 month )
•

Experience:
5+ years of professional software engineering experience

Requirements:
• 5+ years of professional software engineering experience.
• Expert-level proficiency in at least one of Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, or Swift.
• Strong understanding of software security concepts, including CWE, CVE, and the OWASP Top 10.
• Ability to reproduce vulnerabilities and write proof-of-vulnerability tests.
• Hands-on experience with security tooling, including sanitizers, fuzzers,



and static-analysis tools such as CodeQL or Semgrep.
• Strong proficiency with Git, Linux, Bash, and Docker.
• Excellent technical writing and documentation skills.
• Ability to work independently in a fully remote, research-oriented environment. What does day-to-day look like:
• Source and analyze real-world vulnerabilities from CVEs, security advisories, bug reports, and open
- source repositories.
• Classify vulnerabilities using the most specific applicable CWE and map them to relevant OWASP Top 10 categories where appropriate.
• Reproduce vulnerabilities and develop reliable proof-of-vulnerability tests.
• Build Harbor-format audit-and-patch tasks across languages such as Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, and Swift.
• Write realistic task instructions that describe the security issue without revealing the vulnerable code, exploit details, or expected fix.
• Create reproducible Docker-based environments with pinned dependencies and transparent setup procedures.
• Harden verifiers against gaming, overfitting, test manipulation, and hardcoded solutions.
• Screen out tasks that can be solved by copying a well-known upstream patch without understanding the vulnerability.
• Review and score AI-generated patches and reasoning using clearly defined technical rubrics.
• Document vulnerability context, reproduction steps, expected behavior, patch requirements, test methodology, and review decisions.

📌 Senior Software Security Engineer | Remote (India)
🏢 Curvia AI
📍 India