Cybersecurity Expert — Talent Pool

01 — PROJECT

About the project

This is a talent pool application, not a role with an immediate start date.

We are building a vetted network of cybersecurity professionals ahead of upcoming project demand. As AI systems become more capable in security-related tasks, evaluating their performance requires people with real-world technical experience and strong professional judgment.

By applying, you join a curated pool. When a project matching your profile opens, you are contacted directly, with the scope and the compensation laid out upfront. There is no obligation to accept, and no penalty for declining. You stay in the pool for future opportunities.

01 — WHAT THIS WORK TYPICALLY LOOKS LIKE

What this work typically looks like

Projects vary depending on the needs of our AI partners. Typical work may include:

• Evaluating whether an AI system's reasoning about cybersecurity problems is technically correct.
• Designing realistic security scenarios and test cases to evaluate AI capabilities.
• Reviewing AI-generated answers, analyses, or technical decisions.
• Identifying subtle technical errors in otherwise plausible responses.
• Creating evaluation criteria and rubrics that distinguish strong answers from weak ones.
• Reviewing work produced by other cybersecurity professionals.
• Red-teaming or evaluating AI systems within clearly defined and authorized environments.

This is expert, task-based work performed remotely and asynchronously.

02 — REQUIREMENTS

Requirements

You should:

• Have hands-on experience in at least one cybersecurity discipline.
• Be able to provide at least one verifiable signal of your technical background or professional experience.
• Be comfortable reading and writing technical content in English.
• Be willing to complete a background check if required before joining a specific project.
• Follow Vetto's security and authorization standards.

All security-related work must be performed only against systems, environments, and assets that you are explicitly authorized to test, and only within the scope defined by the project.

03 — SELECTION PROCESS

Selection process

Phase 1 — Talent Pool Application

Complete this application with information about your background, experience, and technical work.

We review your professional profile, verifiable signals, and screening responses. There are no interviews at this stage.

Candidates who meet the talent pool criteria become eligible for future cybersecurity opportunities.

Phase 2 — Project Selection

When a project matching your profile becomes available, we will contact you with the complete scope, expected workload, compensation, and timeline.

Depending on the project, you may be asked to complete a short technical exercise designed to resemble the current work.

Performance on project-specific assessments is typically the strongest selection signal.

04 — COMPENSATION

Compensation

Compensation is defined separately for each project and is communicated before you decide whether to participate.

Projects are generally paid per approved task, with payment converted to your local currency where applicable.

Rates vary based on the complexity of the project and the level of expertise required.

02 — ELIGIBILITY

Who can apply

We welcome professionals with hands-on experience across cybersecurity disciplines, including:

• Penetration testers, red team operators, and offensive security engineers.
• SOC analysts, threat hunters, incident responders, and detection engineers.
• Digital forensics and malware analysis professionals.
• Application security and product security engineers.
• Cloud and infrastructure security specialists.
• Security researchers and vulnerability researchers.
• Bug bounty hunters and CTF competitors with a strong, verifiable track record.
• Security architects and GRC professionals with meaningful hands-on technical experience.

What matters most is demonstrable experience solving real security problems.

Evidence may come from professional work, security research, disclosed vulnerabilities, open-source contributions, bug bounty activity, competitive results, or other verifiable technical work.

Certifications can strengthen an application, but they are not required on their own.