Hardware Security Consultant, Penetration Tester

This is a fully remote position, open to applicants in Ohio.

📋 Description

• Support clients in addressing their hardware security requirements

• Carry out hardware security evaluations to detect vulnerabilities

• Assess hardware, associated mobile applications, and backend web infrastructure as an integrated system

• Execute focused web application security assessments

• Generate clear, technically precise reports that include testing procedures, findings, and actionable recommendations tailored for both technical and executive audiences

• Organize client meetings, act as the main point of contact, and engage directly with clients

• Function as a subject matter expert for fellow consultants and teams

• Collaborate with various teams and contribute to TrustedSec’s security knowledge and staff development initiatives

• Enhance and expand cybersecurity knowledge through workshops and continual learning

• Review industry publications, create blog articles, and potentially present at conferences or similar events

• Report directly to the Practice Lead

• Travel to client locations and attend industry-related events

⛳️ Requirements

• Legally permitted to work in the United States

• Must be a resident of the United States; applicants from outside the U.S. will not be considered

• Over 2 years of recent experience in conducting hardware security assessments

• Over 2 years of recent experience in testing web applications and APIs

• Experience in identifying and working with JTAG, SWD, and UART debug interfaces, including finding undocumented test points

• Proficient in firmware extraction and analysis, including methods like debug interfaces, chip-off, or vendor update files

• Skilled in using Ghidra, Binary Ninja, or similar tools for firmware reverse engineering

• Experience assessing Wi-Fi and Bluetooth communications, focusing on traffic flows between devices and mobile applications

• Proficient in Burp Suite or another intercepting proxy tool

• Familiarity with Wireshark for analyzing non-HTTP network traffic

• Experience in bypassing restricted environments on self-service terminals

• Knowledgeable in manual application security testing, penetration testing methodologies, the OWASP Top 10, and the OWASP Testing Guide

• Strong understanding of common security controls and vulnerability assessment techniques

• Excellent time management skills and capability to meet tight deadlines

• Proven analytical and project management abilities

• Exceptional verbal and written communication, active listening, and presentation skills

• Ability to produce technically accurate documents and simplify complex information for non-technical audiences

• Capable of working collaboratively, taking initiative, and functioning independently

• Ability to lift up to 50 pounds on occasion

• Willingness to travel up to 25% annually, including onsite client engagements

• Preferred: experience with cellular-connected device assessments, AT commands, SIM extraction, IMEI spoofing, scripting, AI/LLMs/frontier models/agentic tools/coding assistants, mobile application testing, consulting experience, and industry-recognized security certifications such as OSCP, Burp Suite Certified Practitioner, or OSWE

🏝️ Benefits

• Generous paid time off policy

• Paid holidays

• Performance-based bonus program

• Option to work remotely from home within the United States