What the work actually looks like

You work inside real codebases rather than toy snippets. A typical task might be: locate and explain an injection or deserialization flaw in a Python or Java service, write the patch, and document why the vulnerable pattern occurred and what a correct fix preserves; refactor legacy C++ or Go for memory safety without changing behaviour; or audit a TypeScript backend and produce a prioritised findings write-up. Alongside the code, you produce the reasoning trace — the explanation of how you found the issue, what you ruled out, and what a wrong-but-plausible fix would look like. That written reasoning is often the more valuable half of the deliverable, because it is what the model learns from.

Expect a mix of generation (write the task, the fix, the rationale) and evaluation (compare two model attempts at a security fix and justify which is better, or fail both with reasons). Security work is unusually well-suited to this because model outputs frequently look correct — they compile, they pass the happy path — while leaving the actual vulnerability class intact. Catching that gap is the skill being bought.

What the platform screens for

micro1 runs an AI-led interview of roughly 30 minutes, likely followed by a technical assessment, then hiring manager review. The interview probes depth: expect follow-ups that push past a named vulnerability class into the mechanics of exploitation and mitigation in a specific language and runtime. Vague CVE name-dropping collapses quickly under a second question. They also screen for written clarity, since documentation is a deliverable, and for genuine availability — roles are filled in about 48 hours and first tasks are expected within 24–48 hours of onboarding.

Logistics

  • Contractor, roughly 15 hours per week, fully remote and asynchronous — you pick days and hours, weekends included.
  • Compensation is per accepted task, not hourly; the $30–100/hr band is an observed effective rate that depends on your speed and rework rate, and is not guaranteed.
  • Weekly minimum task submission requirements apply. Rejected or reworked submissions cost you real effective hourly rate.
  • No prior AI or ML experience required; domain depth in security engineering is the qualification.