Cybersecurity RL Environment Reviewer — Security Engineering (Defensive, Cloud & Infrastructure)
Part-Time, Remote
About idlexperts
idleXperts is idler's quality assurance network — the part-time, remote contributors ("experts") who review idler's reinforcement-learning environments before they're delivered to customers. Experts are the last check between what engineering builds and what a customer receives: they confirm a task is solvable as given, confirm the grading actually tests the right thing, and flag anything that would make the task unfair or ambiguous to an AI model attempting it.
About the Role
We're building a dedicated bench of cybersecurity reviewers to QA our defensive-security and infrastructure-security RL environments: detection-engineering tasks, incident-response and root-cause-analysis tasks, cloud/IAM misconfiguration tasks, and digital-forensics tasks. You'll work through environments we've already built and tell us whether they're fair, correct, and ready to ship.
Part-time, flexible-hours contract work; we'll scope weekly workload directly with you.
What You'll Do
Review a described incident, misconfiguration, or detection gap and confirm it's realistic, reproducible from the given logs/environment, and solvable by a skilled practitioner using only the provided context.
For detection/remediation tasks, confirm the grading actually distinguishes a correct fix from an incorrect or incomplete one (e.g., a rule that only coincidentally matches the sample data).
For forensics tasks, confirm the planted artifact is genuinely recoverable through sound method, not by guessing.
Flag inconsistent files, missing context, unclear requirements, or anything that would make the task unsolvable or ambiguous.
Write a short, clear justification for every decision.
What We're Looking For (Minimum Qualifications)
Hands-on experience in at least one of: SOC/detection engineering, incident response, cloud security (AWS/GCP/Azure IAM and misconfiguration), or digital forensics.
Comfortable working with logs, cloud consoles/CLIs, and a common detection-rule language (e.g., Sigma, KQL, or a SIEM's native query language), or standard forensic tooling.
Able to clearly explain, in writing, why a finding is or isn't realistic and correctly graded.
Reliable and self-directed, comfortable working async with limited oversight.
Nice to Have
A certification such as GCIH, GCFA, GREM, CISSP, or a cloud-security credential (e.g., AWS Security Specialty).
Experience building or tuning detection content professionally, not just consuming it.
CTF experience in forensics/misc categories, or past blue-team competition experience (e.g., CPTC, collegiate cyber defense).
Compensation
$65–$100/hour — solid, demonstrable experience in one of the above areas, able to independently verify straightforward tasks.
$125–$250/hour — deep specialist experience (5+ years, advanced certifications, or a track record of building production detection/IR capability), able to handle ambiguous or disputed calls.
How to Apply
Share your resume/LinkedIn plus any relevant certifications, write-ups, or portfolio material. We'll follow up with a short, paid sample review (one task, roughly 30–45 minutes) before starting regular work.