Nebula Security is an AI-native cybersecurity company founded by world-class hackers.
Nebula Security provides Mythos-level cybersecurity reviews and product security auditing, conducted by our state-of-the-art AI agent and world-class hackers themselves, covering everything from code-level vulnerabilities to architectural weak points.
We were the first team to build an nginx RCE and the first to root Android 17. Our co-founders include members of the world’s No. 1 CTF team, DEF CON winners, Black Hat speakers, and PhD in cybersecurity. We have won $400K in bug bounties by exploiting the Linux kernel and Chrome browser.
“Audited by Nebula Security” is a mark of serious security credibility: a signal to customers, investors, and partners that your product has been reviewed by the world’s best hackers.
Last stage
Seed
Investors
Unknown Co-founder 1 (CEO)
PhD in Cybersecurity. Focus on automated vulnerability research. Black Hat USA speaker and DEF CON finalist with r3kapig, world's No. 1 hacking team in 2025. Led DARPA AIxCC automated program repair team.
Unknown Co-founder 2
Black Hat USA speaker. PhD dropout in System Security with experience in DARPA-funded fundamental research on program analysis.
Unknown Co-founder 3
Black Hat USA speaker and DEF CON finalist with r3kapig, world's No. 1 hacking team in 2025. Shipped end-to-end RCE/LPE exploit chains on Chrome, Firefox, Linux, and Android. Pwned Google's kernelCTF multiple times with zero-days. Published at USENIX Security and NDSS. PhD dropout.
Xiaochuan Yu
Founder at Nebula Security (YC S26). Hacked into iPhone, Chrome, Firefox, Safari, QEMU, and various things in your daily life. DEFCON finalist for 3 consecutive years. $200k+ Bug Bounty in Chrome. Core member of r3kapig, the #1 hacking team in the world in 2025, on CTFTime. M.S. from UC San Diego. Research published at USENIX Security, BlackHat. Ph.D. droped out.
No applications, no recruiter spam. Just the intro.
A few questions to make sure this role is the right shape for you. Two minutes.
I write the intro, send it to the founder, and handle the back-and-forth.
If they’re a yes, I book the chat. You show up — that’s the whole job-hunt.