Cybersecurity RL Environment Reviewer — Offensive & AppSec

Part-Time, Remote

We're building a dedicated bench of cybersecurity reviewers to QA our offensive-security and application-security RL environments: vulnerability-discovery tasks, vulnerability-patching tasks, and end-to-end exploit-construction tasks. You'll work through environments we've already built — not build new ones — and tell us whether they're fair, correct, and ready to ship.

This is part-time, flexible-hours part-time work. Most experts work a handful of hours per week; we'll scope specific weekly workload with you directly.

• Review a codebase and a described vulnerability (e.g., SQLi, IDOR, SSRF, insecure deserialization, a memory-safety bug) and confirm it's real, reachable, and findable by a skilled engineer using only the context provided — no outside information required.
• For patching tasks, confirm the grading actually fails while the exploit still works and passes only once it's genuinely fixed — not just pattern-matching a diff.
• For exploit-construction tasks, trace or attempt the intended exploit path yourself to confirm it's achievable within the given environment and constraints.
• Flag inconsistent files, missing context, unclear requirements, or anything that would make the task unsolvable or ambiguous for a model attempting it cold.
• Write a short, clear justification for every accept/reject/flag decision — this matters as much as the decision itself.

• Hands-on experience finding and validating real vulnerabilities in web applications, APIs, or backend services, through bug bounty, penetration testing, red teaming, or AppSec engineering.
• Comfortable reading unfamiliar code (any of Python, JS/TS, Java, Go, C/C++, Rust) well enough to trace a vulnerable data path, even without being a professional software engineer in that language.
• Able to clearly explain, in writing, why a vulnerability is or isn't real and reachable — you'll be judged on your justifications, not just your verdicts.
• Reliable and self-directed, comfortable working async with limited day-to-day oversight.

• An active or past bug bounty track record (HackerOne, Bugcrowd, Synack, Intigriti) — leaderboard ranking, hall-of-fame mentions, or CVE credits are all useful signal.
• CTF experience (web or pwn categories), especially with a public CTFtime team ranking.
• A security certification such as OSCP, OSWE, OSCE, eJPT, eCPPT, or GWAPT.
• Prior experience specifically evaluating or grading other people's security findings (triage, review, or mentorship work).

• $65–$100/hour — solid, demonstrable offensive-security experience (consistent bug bounty activity, 1+ years in an AppSec/pentest role, or a relevant certification) and the ability to independently verify straightforward discovery and patching tasks.
• $125–$250/hour — a recognized track record (top-tier bug bounty leaderboard placement, live-hacking-event invitations, advanced certifications such as OSWE/OSCE, or 5+ years of specialized offensive-security work), able to handle ambiguous or disputed calls and the hardest exploit-chaining tasks.

Exceptional, elite-tier reviewers (e.g., top-50 global bug bounty hunters) may be engaged above this range case-by-case for our highest-difficulty environments.

Share links to your bug bounty profile(s), CTF team page, GitHub, or any public write-ups/CVEs. We'll follow up with a short, paid sample review (one task, roughly 30–45 minutes) as the final step before starting regular work.

idlexperts is idler's quality assurance network — the part-time, remote contributors ("experts") who review idler's reinforcement-learning environments before they're delivered to customers. Experts are the last check between what engineering builds and what a customer receives: they confirm a task is solvable as given, confirm the grading actually tests the right thing, and flag anything that would make the task unfair or ambiguous to an AI model attempting it.