Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 53 days ago

机器人安全攻防研究员（漏洞挖掘方向）

agirobot/campusrecruitment420 open roles

Where
Shanghai, Chinese Mainland
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen now机器人安全攻防研究员（漏洞挖掘方向）agirobot/campusrecruitment · Shanghai, Chinese Mainland

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on agirobot/campusrecruitment's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. agirobot/campusrecruitment postings stay open a median of 1 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 57.8%60 days
This job: posted 53 days ago

agirobot/campusrecruitment median: 1 days open

The posting

1. 漏洞挖掘（核心）：对机器人整机及关键模块（MCU/SoC、主控、通信、传感器、执行器）做深度漏洞挖掘，固件逆向、协议 fuzzing、内存破坏、逻辑缺陷、认证绕过，产出可复现 PoC/EXP。 2. 硬件攻击：拆解与板级分析，UART/JTAG/SWD/SPI/I2C/CAN/USB 接口攻击，Flash dump、调试口绕过、固件提取，必要时故障注入/侧信道提取密钥或绕过校验。 3. 通信与控制链路攻击：ROS2/DDS 话题注入与节点伪造、CAN/CAN-FD 注入、BLE/Wi-Fi/UWB 中间人与重放、MQTT/gRPC 接口攻击，构造从网络立足点到控制权的完整攻击链。 4. Safety × Security 攻击验证（差异化）：证明漏洞如何转化为物理危害——篡改力矩/速度上限、绕过急停与限位、传感器欺骗使机器人误判，量化真实物理影响。 5. 红队评估：以攻击者视角做端到端红队，绕过安全启动、固件签名、防回滚、身份认证等防御机制，验证防御的真实有效性。 6. 能力沉淀：编写高质量漏洞报告与攻击链文档，沉淀可复用的攻击工具、固件分析流水线与红队 TTP。 岗位亮点 1. 面向真实机器人产品，做有物理后果的攻击研究——不止拿 shell，而是证明"能让机器人失控"。 2. 软硬件通吃的攻击场景：从硬件调试口、固件、无线协议到 ROS2 控制链路，攻击面横跨整机。 3. 以攻促防、直连产品：你挖的洞直接驱动量产前修复，攻击成果可沉淀为内部红队能力。

1. 本科及以上，信息安全/计算机/电子/通信/自动化等相关专业。 2. 具备漏洞挖掘、渗透测试、红队、IoT/嵌入式/车联网安全攻防经验。 3. 扎实的固件逆向能力，熟练 IDA / Ghidra，能逆 ARM/MIPS 等嵌入式架构。 4. 实际的漏洞挖掘经验：内存破坏（栈/堆溢出、UAF）、命令注入、认证绕过、协议解析缺陷等，能独立从分析到 PoC。 5. 实际的硬件攻击经验：固件提取、调试口分析、Flash dump，熟悉逻辑分析仪/示波器等。 6. 掌握至少一类机器人/IoT 协议（ROS2/DDS、CAN、BLE、Wi-Fi、MQTT 等）的攻击方法。 7. 熟练 C/C++、Python，能编写 exploit、fuzzer 或自动化攻击工具。 8. 良好的攻击链构造思维与漏洞报告撰写能力。 深度要求：以下方向至少一类达专家深度，其余熟悉即可—— 1. 二进制/固件漏洞：逆向 + 内存破坏漏洞挖掘 + 利用开发； 2. 硬件攻击：板级分析、故障注入、侧信道、调试口绕过； 3. 协议/控制链路：ROS2/DDS、CAN、无线协议的深度攻击与 fuzzing。 加分项 1. CVE、漏洞致谢，或 BlackHat / DEFCON / HITB / 看雪 / GeekPwn / Pwn2Own 等议题/获奖经验。 2. 故障注入（ChipWhisperer）、侧信道、PCB 逆向、芯片级调试实践。 3. fuzzer 开发（AFL/libFuzzer/自研）、固件仿真（QEMU/FirmAE）、exploit 框架使用经验。 4. 机器人、无人机、车载、工控等真实硬件产品的攻防/破解经验。

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against agirobot/campusrecruitment's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on agirobot/campusrecruitment's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    agirobot/campusrecruitment's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.