Senior Engineer – Penetration Testing

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and execute penetration testing strategies for IoT, ICS/OT, and automotive systems.

• Manage engagements from the initial scoping phase to attack-surface prioritization, testing, evidence collection, reporting, and debriefing.

• Leverage Finite State’s platform analysis in conjunction with practical testing to uncover truly reachable and exploitable vulnerabilities.

• Conduct hardware interactions and firmware extraction utilizing JTAG, SWD, UART, SPI, I2C, eMMC, NOR/SPI flash, and NAND flash techniques.

• Solder and modify PCBs to access debugging interfaces.

• Execute firmware reverse engineering using tools such as Ghidra and Binary Ninja.

• Evaluate wireless protocols, vehicle buses, industrial control protocols, network protocols, cloud services, mobile companion applications, and APIs.

• Undertake source code reviews in C, C++, and related embedded programming languages.

• Assess third-party and open-source components through SBOM analysis and software composition assessments.

• Utilize approved AI-driven security tools and LLM-assisted workflows for analysis, triage, and reporting tasks.

• Assess products against applicable regulations and industry standards.

• Generate comprehensive reports detailing technical findings, risk ratings, remediation recommendations, CVSS scores, exploitability prioritization, and VEX justifications.

• Engage in peer reviews of deliverables related to engagements.

• Assist in customer scoping discussions, technical debriefings, and follow-up on remediation efforts.

• Collaborate with product, engineering, and research teams to enhance platform detection capabilities.

• Contribute to knowledge sharing, tool development, and improvement of methodologies.

⛳️ Requirements

• Bachelor's degree in Computer Science, Electrical Engineering, Computer Engineering, or a related discipline, or equivalent practical experience.

• Over 7 years of hands-on experience in IoT, embedded, ICS/OT, or automotive security.

• Proven experience managing engagements independently at a senior level.

• In-depth hands-on expertise in at least one of the target domains: IoT/embedded, ICS/OT, or automotive, along with working knowledge of the other two.

• Proficient in JTAG/SWD debugging, SPI/I2C/UART communication, and flash memory extraction techniques.

• Comfortable with soldering and reworking PCBs to access debugging interfaces.

• Skilled in using Ghidra and/or Binary Ninja for reverse engineering.

• Capable of analyzing ARM, MIPS, PPC, RISC-V, x86, and x64 architectures.

• Experienced in testing BLE, Zigbee, Z-Wave, Wi-Fi, and cellular communication protocols.

• Knowledgeable about vehicle buses and industrial control protocols such as CAN, LIN, automotive Ethernet, Modbus, DNP3, EtherNet/IP, or OPC-UA.

• Familiar with network protocols and methodologies for testing web and mobile applications.

• Capable of reviewing C and C++ source code for security vulnerabilities.

• Acquainted with SBOM concepts and the CycloneDX/SPDX formats.

• Proficient in CVSS scoring and VEX methodologies.

• Able to align findings with relevant regulatory or standards frameworks.

• Exceptional written and verbal communication skills along with technical reporting proficiency.

• Experience in Python and Bash scripting for automation tasks.

• Familiarity with AI-enhanced security tools and LLM-based workflows.

• Must be authorized to work in the U.S. without requiring sponsorship.

• Some projects necessitate eligibility as a U.S. person under ITAR/EAR regulations.

🏝️ Benefits

• A fully remote workforce and a culture that prioritizes remote work.

• No relocation necessary for remote positions.

• Limited travel obligations, including occasional visits for customer-site assessments, conferences, and team events.

• Finite State provides and funds a bench lab equipped with soldering and rework stations, probes, programmers, logic analyzers, and radios.

• Opportunities for platform integrations, direct account management, and the development of tools that drive business success.

• Chances to participate in industry conferences, publish research, and represent Finite State externally.

• Commitment to equal employment opportunities and reasonable accommodations for applicants with physical and mental disabilities.