At one place, fresh out of college, I quickly found myself tracing trough about 1000 lines of assembly code for trap/exception/interrupt handling. That job was to develop an embedded supercomputer OS kernel. (for use in aircraft and submarines)

Amazon wanted me diagnosing Linux kernel "oops" reports. That would involve looking at hex dumps and register dumps, then mapping that back to C source code to determine the problem.

There was a place that would have had me writing bare-metal software to generate high-volume network packets for testing network gear.

One place had me port some Linux kernel changes, including assembly code, to x86_64.

Currently I mostly write emulators for undocumented hardware. I use IDA Pro as my disassembler. I keep that running all the time. I can spot a security vulnerability as I look at the binary executable in the disassembler; this is an expected part of the job. Sometimes I need to write assembly code or even raw hex bytes in order to demonstrate how things can happen. At one point I had to write assembly code such that the 16-bit checksum of the binary code didn't exceed 0xffff, not counting the last 2 bytes. Another time I had to write code that didn't have any 0x00 bytes in it; this required modifying the instructions in a hex editor.