Nullify runs autonomous security work most teams can't staff for. This role is the human edge of that — validating what our agents find, going after what they can't, and feeding every technique back into the system so it gets sharper.
What you'll doRun deep, manual web app pentests against customer surface area that automated scanning alone won't catch — auth flows, business logic, multi-step exploit chains.
Turn novel findings into reproducible techniques that get encoded back into Nullify's detection and validation agents.
Partner with customer security teams during engagements, from scoping through report-back.
Keep pace with the frontier: new frameworks, new auth patterns, new classes of vulnerability.
Real-world experience finding and exploiting vulnerabilities in production web applications — OWASP Top 10 and beyond.
Comfort working close to the metal: reading application code, tracing requests, building custom tooling when off-the-shelf doesn't cut it.
A bias toward proof over speculation — you validate before you report.
Bonus: experience training or evaluating AI systems on security tasks.
Skills Required
- Real-world experience finding and exploiting vulnerabilities in production web applications
- Knowledge of the OWASP Top 10 and vulnerabilities beyond it
- Ability to read application code and trace requests
- Ability to build custom security tooling when necessary
- Ability to validate vulnerabilities before reporting them
- Experience training or evaluating AI systems on security tasks
What We Do
Black Nova Venture Capital is an early-stage venture investor focused on pre-seed and seed B2B technology startups in the APAC region. Headquartered in Sydney, the firm partners with founders by providing capital, strategic guidance and operational support to help startups scale. Black Nova seeks technology-driven companies across sectors and aims to add hands-on value beyond funding to accelerate growth.
