Senior Engineer - Penetration Testing

Role overview Lead hands-on security assessments of connected devices and embedded systems, focusing on IoT, industrial control, or automotive targets. You will manage customer engagements from scoping through reporting, combining hardware access, firmware analysis, and practical exploitation to explain which risks are demonstrable and how they can be addressed. The role is remote within the United States, with occasional travel for customer work and team events.

Responsibilities - Scope and conduct penetration tests on connected products, industrial controllers, vehicle systems, and related software or network surfaces. - Independently prioritize targets, gather evidence, document findings, and present results in reports and technical debriefs. - Extract and examine firmware using debug interfaces and flash storage techniques; modify or rework boards when needed to gain access. - Reverse engineer firmware and assess wireless, vehicle bus, industrial, network, mobile, and web attack surfaces as relevant to each engagement. - Review embedded source code and software component inventories, and prioritize issues based on demonstrated exploitability. - Review colleagues’ deliverables, support remediation discussions, and share findings with product, engineering, and research teams to improve analysis methods and tools.

Requirements - At least seven years of hands-on security experience in IoT or embedded, industrial control, or automotive systems, including autonomous ownership of senior-level engagements. - Degree in computer science, electrical or computer engineering, or a related area, or equivalent practical experience. - Deep expertise in at least one target domain and working familiarity with the other two. - Practical hardware assessment skills, including JTAG or SWD, serial and peripheral interfaces, flash extraction, and PCB soldering or rework. - Firmware reverse engineering experience with Ghidra or Binary Ninja and ability to analyze common embedded and desktop processor architectures. - Experience testing wireless protocols and either automotive buses or industrial control protocols; working knowledge of networking and web or mobile testing is also expected. - U.S. work authorization without sponsorship; some assignments are restricted to U.S. persons under export rules.

Nice to have - Fine-pitch or BGA board rework experience. - Experience with platform integrations, tool building, security research, or publishing technical findings.