Principal Penetration Tester, Embedded Devices

TP-Link Systems Inc. • Irvine, CA

3d • $220,000 - $230,000

About The Position

TP-Link Systems Inc. is seeking a Principal Penetration Tester to define and lead the technical strategy for offensive security across its embedded product portfolio. This individual-contributor leadership role establishes advanced testing methodologies, leads complex assessments of IoT ecosystems, and influences product architecture and security priorities across business and engineering teams. The role serves as a technical authority for vulnerability research, exploit development, threat modeling, coordinated vulnerability response, and security validation throughout the product lifecycle.

The successful candidate brings deep hands-on expertise in embedded systems security and strategic judgment to identify systemic risk, build reusable testing capabilities, mentor senior engineers, and communicate significant findings to engineering and executive stakeholders. The position aims to advance TP-Link’s offensive security program and help ensure products meet evolving global cybersecurity standards and regulatory expectations.

Requirements

• Bachelor’s degree in computer science, computer engineering, electrical engineering, information security, or a related field, or equivalent practical experience.
• At least 8 years of progressive experience in embedded-device security, penetration testing, vulnerability research, exploit development, or a closely related discipline, including technical leadership across complex programs.
• Expert-level knowledge of embedded architectures, firmware, operating systems, secure boot, hardware security mechanisms, protocol security, cryptography, wireless technologies, and common vulnerability classes.
• Extensive hands-on experience with security tools and techniques such as Burp Suite, Nmap, Kali Linux, Nessus, Metasploit, IDA Pro, Ghidra, JTAG/SWD interfaces, logic analyzers, debuggers, and hardware or firmware extraction, including customizing or extending tools.
• Ability to design advanced penetration-testing methodologies, fuzzing strategies, automated security-testing platforms, and repeatable assessment frameworks for diverse product families.
• Expertise in reverse engineering, binary analysis, exploit development, and vulnerability discovery across hardware, firmware, applications, network services, cloud components, and mobile ecosystems.
• Advanced programming and scripting skills in languages such as C/C++, Python, Bash, and PowerShell, including the ability to build security tools, automation, and proof-of-concept exploit code.
• Ability to influence architecture and engineering decisions without direct authority, lead technical reviews, mentor experienced engineers, and communicate risk to technical and executive audiences.
• Recognized technical leadership and a record of mentoring senior and developing engineers.
• Exceptional written and verbal communication skills, including presenting complex risk and remediation recommendations to executive and engineering audiences.
• Strategic thinking, sound judgment, and the ability to prioritize systemic risk across multiple products and concurrent initiatives.
• High ownership, intellectual curiosity, and ability to work independently while building alignment across product, R&D, QA, legal, compliance, and business teams.

Nice To Haves

• Advanced certifications such as OSCP, OSEP, OSWE, GXPN, GREM, CISSP, or comparable demonstrated expertise.
• Publicly credited CVEs, security research, conference presentations, patents, or significant open-source contributions.

Responsibilities

• Define and execute the enterprise technical strategy, roadmap, and standards for penetration testing across embedded devices, mobile applications, cloud services, APIs, wireless interfaces, and IoT ecosystems.
• Lead complex, high-risk penetration tests and architecture-level security assessments across product lines, covering hardware, firmware, boot chains, operating systems, cryptographic implementations, protocols, and supporting services.
• Conduct vulnerability research, develop proof-of-concept exploits, analyze root causes, and identify systemic vulnerability patterns across products and platforms.
• Establish scalable threat-modeling practices and advise product architects and engineering leaders on secure design decisions, compensating controls, and risk acceptance.
• Architect and develop custom security tools, fuzzing harnesses, firmware-analysis pipelines, exploit frameworks, and automated testing platforms.
• Integrate offensive security requirements and validation gates into the secure product development lifecycle, including design reviews, pre-release testing, and post-release assurance.
• Provide senior technical leadership during critical product-security incidents and coordinated vulnerability disclosures, including severity assessment, exploitation analysis, remediation validation, and lessons learned.
• Serve as a technical authority for product cybersecurity certifications, standards, and regulatory assessments, including NIST, ETSI EN 303 645, SOG-IS, and other applicable global requirements.
• Mentor penetration testers and product-security engineers, establish review standards, lead technical communities of practice, and strengthen offensive-security capabilities across R&D and QA.
• Communicate technical findings as business risks, remediation priorities, and strategic recommendations to product, engineering, legal, compliance, and executive stakeholders.

Benefits

• Fully paid medical, dental, and vision insurance, with partial coverage for dependents.
• Contributions to 401(k) funds.
• Over four weeks of paid time off per year.
• Bi-annual pay increases.
• Health and wellness benefits, including a free gym membership.
• Quarterly team-building events.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal