Company Description:

Curvia AI is a London, UK-based technology and AI solutions company that transforms complexity into opportunity through enterprise solutions, AI-powered automation, and data-driven insights. We build practical, scalable, and human-centered technology grounded in integrity, security, and responsible innovation.

Role Overview

We are seeking a Senior Software Security Engineer to develop high-quality training and evaluation tasks for frontier AI coding models. You will transform real-world open-source vulnerabilities—including CVEs, security advisories, and bug reports—into Harbor-format audit-and-patch tasks across multiple programming languages. This role combines software security research, vulnerability reproduction, benchmark development, automated testing, and technical review.

Offer Details:

- Commitments Required: 8 hours per day with an overlap of 4 hours with PST.
- Employment type: Contractor assignment (no medical/paid leave)
- Contract Length: Short Term Contract (3 month )
- Experience: 5+ years of professional software engineering experience

Requirements:

- 5+ years of professional software engineering experience.
- Expert-level proficiency in at least one of Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, or Swift.
- Strong understanding of software security concepts, including CWE, CVE, and the OWASP Top 10.
- Ability to reproduce vulnerabilities and write proof-of-vulnerability tests.
- Hands-on experience with security tooling, including sanitizers, fuzzers,



and static-analysis tools such as CodeQL or Semgrep.
- Strong proficiency with Git, Linux, Bash, and Docker.
- Excellent technical writing and documentation skills.
- Ability to work independently in a fully remote, research-oriented environment.

What does day-to-day look like:

- Source and analyze real-world vulnerabilities from CVEs, security advisories, bug reports, and open- source repositories.
- Classify vulnerabilities using the most specific applicable CWE and map them to relevant OWASP Top 10 categories where appropriate.
- Reproduce vulnerabilities and develop reliable proof-of-vulnerability tests.
- Build Harbor-format audit-and-patch tasks across languages such as Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, and Swift.
- Write realistic task instructions that describe the security issue without revealing the vulnerable code, exploit details, or expected fix.
- Create reproducible Docker-based environments with pinned dependencies and transparent setup procedures.
- Harden verifiers against gaming, overfitting, test manipulation, and hardcoded solutions.
- Screen out tasks that can be solved by copying a well-known upstream patch without understanding the vulnerability.
- Review and score AI-generated patches and reasoning using clearly defined technical rubrics.
- Document vulnerability context, reproduction steps, expected behavior, patch requirements, test methodology, and review decisions.

📌 Senior Software Security Engineer | Remote (India)
🏢 Curvia AI
📍 India