We don't hire headcount. We keep an arsenal.
Vulnary runs lean and adversarial. When an engagement outgrows the core team, we don't scramble — we reach into a pre-vetted bench of operators we already trust. This is the door to that bench.
An elite network, not a roster.
Most consultancies grow by hiring people they then have to keep busy. We grew the other way: a tiny core of principals, an autonomous researcher that never sleeps, and a curated network of specialists we call in when the work demands a particular edge. You stay independent. We bring you the engagements your skills were sharpened for — and the proof-driven culture to do them in.
- Real work, not bench-warming. You're called for engagements that fit your edge — overflow on Sprints and Campaigns, second pairs of eyes, specialist passes the core team can't cover alone.
- Proof over paperwork. We sell working exploits and the fixes that end them — not risk scores. The culture rewards the operator who lands the shell, not the one who writes the longest caveat.
- Stay independent. No exclusivity, no quota. You keep your own practice; we keep your number for when something interesting lands.
- Work beside The Resident. Our autonomous adversary does the grind — recon, reconstruction, triage — so your hours go where the human edge actually matters.
Operators who land the proof.
We're discipline-agnostic about titles and obsessive about evidence. Show us something you broke. Depth in one of these wins over a shallow sweep of all four.
- web & network
- cloud / AD
- red-team ops
- full kill-chain
- source audit
- taint & call-flow
- SAST triage
- proof-driven
- CVE / 0-day
- weaponized PoC
- reverse engineering
- fuzzing
- prompt injection
- jailbreak automation
- model extraction
- agent abuse
Self-taught and decorated welcome alike. We weight a public CVE, a clean write-up, a CTF podium, or a bug-bounty wall over any certification. Bring links.
Apply. Screen. Stay on-call.
The bench is vetted, not crowdsourced. Everyone on it has been screened by a principal and proven they can land a result. Here's the path in.
- 01Apply
Send your strongest evidence — a CVE, a PoC, a write-up, a CTF result, a repo. One real thing you broke beats a polished CV. No cover letters.
- 02Screen
A principal reads your work. We're looking for depth, sound method, and proof — not breadth. If the work lands, you move forward.
- 03Interview
A working conversation with the people you'd actually run beside — sometimes a small hands-on challenge in your discipline. Technical, candid, two-way.
- 04On the bench
You join the vetted network as a trusted reference and on-call capacity. We reach out when an engagement needs your edge — overflow, specialist passes, second eyes. Independent, no quota.
Think you'd sharpen
the bench?
No quota, no exclusivity. Send proof — we read every one.