SecLib

岗位技能 → 精读：招聘方在要什么，站里哪几篇值得先读

• 大模型安全 / 模型攻防 AI 安全 89
  月薪中位 30–50k（65 个标了薪资，区间 10–300k） · 北京 42 / 上海 27 / 杭州 14 / 南京 6
  先读：AI 安全攻击面的过去现在与未来Threat Modeling LLMs The PHANTOM-B modelPersistent Pre-Training Poisoning of LLMsPoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation从字节到神经元——一名二进制安全研究员的 AI 安全研究
• Agent 安全 AI 安全 61
  月薪中位 30–50k（29 个标了薪资，区间 14–90k） · 上海 27 / 杭州 21 / 南京 7 / 北京 6
  先读：No Tools Required Post-Injection Exploitation Across AI Agent FrameworksCaging the Agent How Roblox Built Multi-Layer Sandboxes to Secure Claude Code at Enterprise ScaleThe CoreBreak Attack Turning AI Agents into Credentials Exfiltration VectorsTrusted Enough to Run Breaking AI Agents in Official Workflows_CompressedAI Agent 攻防下的代码保护之道
• 合规 / 安全体系与治理 治理 38
  月薪中位 25–45k（27 个标了薪资，区间 8–80k） · 上海 15 / 杭州 10 / 北京 5 / 成都 5 / 南京 3
  先读：The Intent Gap Where Every AI Regulation Falls Short and What Security Leaders Need InsteadSAGE: Scalable AI Governance & EvaluationReshaping the SDLC for Data- and AI-Centric SystemsManaging Security Culture Half LifePrivacy at Scale Roblox's Infrastructure for Honoring User Privacy Rights
• 渗透测试 / 红蓝对抗 攻防 29
  月薪中位 27.5–50k（18 个标了薪资，区间 10–90k） · 上海 16 / 杭州 5 / 南京 4 / 北京 2 / 成都 2
  先读：Bring Your Own COM - Session Pivoting and Lateral Movement via Ephemeral COM RegistrationIdentity Crisis Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain TakeoverPre-auth RCE in Enterprise Java When Middleware Becomes the ExploitCRLF-Powered Desync Attacks Beheading HTTP Streams一次渗透 Agent 的架构减法实践：大模型、工具和Harness谁更重要？
• 应用安全 / SDL / 供应链 治理 23
  月薪中位 20–30k（19 个标了薪资，区间 10–70k） · 成都 13 / 杭州 6 / 北京 3 / 南京 1
  先读：Reshaping the SDLC for Data- and AI-Centric SystemsScanning the Scanners Turning Security Vendors Into Supply Chain WeaponsBorn Corrupted How We Backdoored Trusted Language BinariesTurning Enterprise Update Servers Into Backdoor Factories (0_o)Daniel Begimher&Cristian LeoThreatForest Automated Attack Trees from Source Code
• 提示注入 / 越狱 AI 安全 22
  月薪中位 30–50k（9 个标了薪资，区间 14–80k） · 上海 10 / 杭州 9 / 南京 2 / 北京 1
  先读：Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt InjectionInjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model AgentsINFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic SystemsChatMate Remote Prompt Execution on AI Assistants through Sandbox EscapingRules for Neural Traffic A New Defensive Layer for LLMs
• 模型训练 / 微调 / 算法 AI 安全 21
  月薪中位 27.5–50k（14 个标了薪资，区间 10–80k） · 上海 10 / 北京 5 / 南京 3 / 杭州 3
  先读：Cost-Effective, Private, Frontier-Grade AI Agent Exploitation with a Fine-Tuned OSS ModelPersistent Pre-Training Poisoning of LLMs从字节到神经元——一名二进制安全研究员的 AI 安全研究
• 安全运营 / SOC 防守 20
  月薪中位 27.5–50k（18 个标了薪资，区间 5–70k） · 上海 7 / 北京 7 / 杭州 4 / 成都 2
  先读：From Prompts to Pipelines Building Agentic Detection Engineering and Threat HuntingClosed Loop From Autonomous Exploit to Deployed Defense in Under 5 MinutesGitHub Can Tell You're Being Hacked. You're Just Not Listening Building EDR for GitHub from Its Own Event StreamManaging Security Culture Half Life
• 漏洞挖掘 / 安全研究 攻防 18
  月薪中位 22.5–47.5k（14 个标了薪资，区间 15–70k） · 成都 5 / 上海 4 / 南京 4 / 北京 3 / 杭州 2
  先读：Vulnerabilities Assembled! The Vulnerability Factory Inside the Windows KernelThe 0-Day Engine Finding 100+ Vulns with LLMs in Chrome and AndroidStorm：AI 审计时代下，Fuzzing 还有用吗？Apple macOS Kernel Exploitation with MIE Building on the Ashes of 100 VulnerabilitiesA 0-Click Exploit Chain for the Pixel 10
• IoT / 硬件 / 车联网 基础设施 18
  月薪中位 20–30k（13 个标了薪资，区间 7–70k） · 成都 8 / 上海 4 / 北京 2 / 南京 2 / 杭州 2
  先读：物理世界的自动化攻防：Agent 小队无人值守IoT漏洞挖掘实践One Percent of the Tokens, All of the Strategy LLM-Assisted Vulnerability Discovery in IoT and Embedded Firmware从漏洞检测到利用：知识驱动的 RISC-V 硬件安全分析技术Tractor ECU RE When a Noise Triggered Recall is Also a Security PatchTiny Chips, Big Leaks Breaking TrustZone-M with Single-Stepping Attacks
• 身份与访问 / 零信任 基础设施 15
  月薪中位 30–50k（6 个标了薪资，区间 14–80k） · 上海 7 / 杭州 4 / 南京 3 / 北京 1
  先读：Identity Crisis Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain TakeoverHandle With Care Chaining Azure Automation Flaws for Cross-Tenant Identity TakeoverPass-the-Passkey Family of AttacksThe CoreBreak Attack Turning AI Agents into Credentials Exfiltration Vectors
• AI 红队 / 安全评测 AI 安全 13
  月薪中位 30–55k（6 个标了薪资，区间 14–80k） · 上海 8 / 杭州 3 / 北京 1 / 南京 1
  先读：INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic SystemsBeyond Detection What We Learned Testing Every AI Approach to Vulnerability ClassificationSAGE: Scalable AI Governance & EvaluationAI 安全攻击面的过去现在与未来
• 反入侵 / 威胁检测 防守 12
  月薪中位 25–42.5k（8 个标了薪资，区间 20–80k） · 杭州 4 / 上海 3 / 南京 3 / 北京 2
  先读：From Prompts to Pipelines Building Agentic Detection Engineering and Threat HuntingGitHub Can Tell You're Being Hacked. You're Just Not Listening Building EDR for GitHub from Its Own Event StreamIf the Adversary Lives Off Your Land, So Should YouRules for Neural Traffic A New Defensive Layer for LLMsCracking the Chains Accelerating Ransomware Recovery via LLM-Assisted Engineering an
• 云安全 基础设施 10
  月薪中位 26.5–50k（10 个标了薪资，区间 15–70k） · 北京 3 / 成都 3 / 上海 2 / 杭州 2
  先读：Handle With Care Chaining Azure Automation Flaws for Cross-Tenant Identity TakeoverBreaking Multi-Tenancy Over and Over, and What We Can Learn From ThisThe Crypto Caper Exposing a Sophisticated Multi-Cloud BanditWhen Agentic Glue Melts Exploiting Cloudflare CodeMode and Workers
• 自动化渗透 / AI 漏洞挖掘 AI 安全 9 样本少
  月薪中位 35–57.5k（4 个标了薪资，区间 25–90k） · 上海 4 / 杭州 3 / 北京 1 / 南京 1
  先读：一次渗透 Agent 的架构减法实践：大模型、工具和Harness谁更重要？ZeroMDASH：领域自适应的Agent-Native 通用漏洞挖掘工程The 0-Day Engine Finding 100+ Vulns with LLMs in Chrome and AndroidClosed Loop From Autonomous Exploit to Deployed Defense in Under 5 Minutes物理世界的自动化攻防：Agent 小队无人值守IoT漏洞挖掘实践
• 容器 / 沙箱隔离 基础设施 8 样本少
  月薪中位 35–60k（2 个标了薪资，区间 30–70k） · 上海 4 / 杭州 4
  先读：!secure A Single Wrong Negation to Root Linux and Escape Managed ContainersBeyond Seccomp Breaking and Rebuilding Syscall Filtering for MicroservicesCaging the Agent How Roblox Built Multi-Layer Sandboxes to Secure Claude Code at Enterprise ScaleBreaking Multi-Tenancy Over and Over, and What We Can Learn From This
• 网络与基础设施安全 基础设施 7 样本少
  月薪中位 35–50k（7 个标了薪资，区间 10–80k） · 成都 3 / 上海 2 / 南京 2
  先读：Breaking Trust Boundaries Exploiting Design Assumptions in Network InfrastructureZero-Day Provisioning Chaining TP-Link ZTP Vulnerabilities for Infiltrating NetworksRoot From Kilometers Away Ubiquiti AirMax RCEgpwn Wiretapping Fiber ISP Deployments From the Comfort of Your Home_Compressed
• 数据安全 / 隐私 治理 6 样本少
  月薪中位 30–45k（5 个标了薪资，区间 15–80k） · 上海 2 / 南京 2 / 北京 1 / 杭州 1
  先读：Privacy at Scale Roblox's Infrastructure for Honoring User Privacy RightsThe CoreBreak Attack Turning AI Agents into Credentials Exfiltration VectorsInvisible Threads Remote Building Surveillance Through Encrypted Thread Traffic AnalysisCriteria and Analysis for Human-Centered Browser Fingerprinting Countermeasures
• 逆向 / 二进制 攻防 3 样本少
  月薪中位 27.5–50k（2 个标了薪资，区间 25–50k） · 成都 2 / 杭州 1
  先读：Breaking the Seal Static Deobfuscation of Compiled V8 JavaScript Bytecode MalwareRender Safe Reverse Engineering and Exploiting an EOD Robot_CompressedTractor ECU RE When a Noise Triggered Recall is Also a Security PatchWhen Queues Become Vulnerabilities Reverse Engineering GCD, XPC Races, and macOS Detection Engineering_Compressed大语言模型驱动的移动软件安全分析实践
• 移动安全 攻防 3 样本少
  月薪中位 25–50k（3 个标了薪资，区间 25–60k） · 北京 1 / 南京 1 / 成都 1
  先读：大语言模型驱动的移动软件安全分析实践A 0-Click Exploit Chain for the Pixel 10One Click to System Exploiting Bixby's Trust Model for Full Device CompromiseHunting LANDFALL From Overlooked Images to State-Linked Mobile Spyware
• RAG / 检索与推荐安全 AI 安全 3 样本少
  月薪中位 20–40k（1 个标了薪资，区间 20–40k） · 上海 2 / 杭州 1
  先读：PoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented GenerationGASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-Based SearchStealthRank: LLM Ranking Manipulation via Stealthy Prompt OptimizationDecoupling Search from Reasoning: A Vendor-Agnostic Grounding Architecture for LLM Agents
• 证书：CISSP / CISP 证书 2 样本少
  月薪中位 32.5–52.5k（2 个标了薪资，区间 25–55k） · 上海 2
• Golang 编程 1 样本少
  月薪中位 40–55k（1 个标了薪资，区间 40–55k） · 上海 1

来源：BOSS直聘、猎聘、企业官网及招聘聚合站的公开职位信息，聚合整理；已去除招聘者姓名、职务、活跃时间和联系方式。 技能由岗位标题、标签与职位描述片段按词表归一；技能与议题的对应由人工按议题内容挑选。岗位以招聘页为准，本站不保证仍在招。