Senior Engineer – Penetration Testing

This is a fully remote position, open to applicants in United States.

📋 Description

• Strategically plan and conduct penetration tests on IoT, ICS/OT, and automotive targets.

• Independently manage engagements, encompassing scoping, prioritization of attack surfaces, testing, evidence collection, reporting, and debriefing.

• Utilize Finite State’s platform analysis in conjunction with hands-on testing to discover genuinely reachable and exploitable vulnerabilities.

• Execute hardware interactions and firmware extractions using JTAG, SWD, UART, SPI, I2C, eMMC, NOR/SPI flash, and NAND flash dumping.

• Solder and modify PCBs to access debugging interfaces.

• Perform firmware reverse engineering with tools such as Ghidra and Binary Ninja.

• Evaluate wireless protocols, including Bluetooth/BLE, Zigbee, Z-Wave, Wi-Fi, and LTE/5G.

• Analyze vehicle buses and industrial control protocols.

• Examine standard network protocols, exposed services, cloud and mobile companion applications, and APIs.

• Conduct source code reviews in C, C++, and associated embedded languages.

• Review third-party and open-source components, including SBOM reviews and software composition analysis.

• Employ approved AI-powered security tools and LLM-assisted workflows for analysis, triage, and reporting.

• Assess products in relation to relevant regulations and standards.

• Generate reports that convey technical findings, risk ratings, CVSS scores, exploitability, VEX justifications, and remediation guidance.

• Engage in peer review of engagement deliverables.

• Assist in customer scoping calls, technical debriefs, and follow-up on remediation efforts.

• Collaborate with product, engineering, and research teams to enhance the Finite State platform.

• Contribute to knowledge sharing, tooling development, and the advancement of methodologies.

• Participate in conferences, publish research, and represent Finite State externally.

⛳️ Requirements

• A Bachelor’s degree in Computer Science, Electrical Engineering, Computer Engineering, or a related discipline, or equivalent practical experience.

• Over 7 years of hands-on experience in IoT, embedded, ICS/OT, or automotive security.

• Proven ability to manage engagements autonomously at a senior level.

• In-depth practical experience in at least one target domain: IoT/embedded, ICS/OT, or automotive, with familiarity in the other two.

• Experience conducting hardware-level security assessments, including JTAG/SWD debugging, SPI/I2C/UART communication, and flash memory extraction.

• Proficient in soldering and reworking PCBs to access debugging interfaces.

• Expertise in using Ghidra and/or Binary Ninja.

• Capability to analyze ARM, MIPS, PPC, RISC-V, x86, and x64 architectures.

• Experience in testing wireless protocols and either vehicle buses or industrial control protocols.

• A working knowledge of network protocols and web/mobile application testing methodologies.

• Competence in reviewing C and C++ source code for security vulnerabilities.

• Familiarity with SBOM concepts and formats, including CycloneDX and SPDX.

• Proficient understanding of CVSS scoring and VEX.

• Ability to correlate findings to at least one relevant regulatory or standards framework.

• Exceptional written and verbal communication abilities.

• Experience with Python and Bash scripting and automation.

• Familiarity with AI-assisted security tooling and LLM-based workflows.

• Must be authorized to work in the U.S. without sponsorship.

🏝️ Benefits

• Finite State provides and funds a bench lab, which includes a soldering and rework station, probes, programmers, logic analyzers, and radios.

• A fully distributed workforce with a remote-first culture.

• Minimal travel required, including occasional customer-site assessments, conferences, and team gatherings.

• Opportunities for platform integrations, direct account management, and the development of business-driving tools.

• Opportunities to participate in industry conferences, publish research, and represent the organization externally.