Senior Engineer - Penetration Testing

Finite State

5h • Remote

About The Position

Finite State is seeking a Senior Engineer — Penetration Testing to join its Offensive Security team. This hands-on role conducts hardware and software penetration tests of connected devices, embedded systems, industrial control systems, and automotive platforms for customers. The engineer combines hardware and firmware expertise with a consultative approach to provide clear, actionable findings that help manufacturers and operators understand and reduce product risk. Finite State’s firmware analysis platform supports the work, allowing testing to focus on whether vulnerabilities are reachable and exploitable on real hardware.

The primary responsibility is autonomous delivery of penetration-testing engagements, including scoping, attack-surface prioritization, testing, evidence collection, reporting, and customer debriefs. Work includes hardware interaction and firmware extraction, reverse engineering, wireless and network testing, source-code review, supply-chain analysis, standards and regulatory assessment, and customer-facing remediation support. The engineer also participates in peer review and contributes findings, tooling, and methodology improvements to Finite State’s product, engineering, and research teams. Over time, there may be opportunities to take on platform integrations, direct account ownership, and business-focused tool development.

The role is remote-first and based in the United States, with limited travel for customer-site assessments, conferences, and team gatherings. Finite State provides and funds the bench-lab equipment, including soldering and rework equipment, probes, programmers, a logic analyzer, and radios. Some engagements involve customer sites with live industrial or medical equipment and require following customer safety procedures and agreed rules of engagement; testing production OT is never performed without written authorization. Some customer hardware and technical data is subject to U.S. export controls, and a subset of engagements is restricted to U.S. persons. Candidates must be authorized to work in the United States without sponsorship.

Requirements

• Bachelor's degree in Computer Science, Electrical Engineering, Computer Engineering, or a related field, or equivalent hands-on experience.
• At least 7 years of hands-on experience in IoT, embedded, ICS/OT, or automotive security, with a record of autonomously owning engagements at a senior level.
• Hands-on depth in at least one target domain—IoT/embedded, ICS/OT, or automotive—and working familiarity with the other two.
• Experience performing hardware-level security assessments, including JTAG/SWD debugging, SPI/I2C/UART communication, and flash-memory extraction.
• Comfort soldering and reworking PCBs to access debug interfaces.
• Proficiency with Ghidra and/or Binary Ninja and ability to analyze ARM, MIPS, PPC, RISC-V, x86, and x64 architectures.
• Experience testing wireless protocols (BLE, Zigbee, Z-Wave, Wi-Fi, and cellular) and either vehicle buses (CAN, LIN, automotive Ethernet) or industrial-control protocols (Modbus, DNP3, EtherNet/IP, OPC-UA), consistent with domain depth and familiarity across the other target domains.
• Working familiarity with standard network protocols and web/mobile application testing methodology.
• Ability to read and review C and C++ source code to identify memory-safety issues, authentication flaws, and other embedded-software security weaknesses.
• Familiarity with SBOM concepts and formats such as CycloneDX and SPDX, and with using SBOMs in vulnerability management.
• Working fluency with CVSS scoring and VEX, including defending exploitability determinations to customers.
• Ability to map findings to at least one relevant regulatory or standards framework and explain implications to customers.
• Excellent written and verbal communication skills, including the ability to produce well-structured technical reports and present findings to diverse audiences.
• Experience scripting and automating with Python and Bash.
• Familiarity with AI-assisted security tooling and interest in applying LLM-based workflows to security analysis and reporting.
• Authorization to work in the United States without sponsorship.

Nice To Haves

• Fine-pitch and BGA PCB rework experience.
• Hands-on automotive security experience, including OBD-II assessment, ECU flashing and analysis, V2X protocols, or automotive HSM evaluation.
• Experience with ICS/SCADA security assessments and protocols such as Modbus, DNP3, EtherNet/IP, or OPC-UA.
• CVE or responsible-disclosure history, or other demonstrated exploit development or vulnerability research.
• Offensive Security certifications such as OSCP or OSWE; SANS/GIAC certifications such as GPEN or GICSP; or vendor-specific automotive security credentials.
• Working knowledge of a subset of relevant regulations and standards, including the EU Cyber Resilience Act (CRA), CE RED / EN 303 645, UNECE WP.29 / ISO 21434, IEC 62443, FDA premarket cybersecurity requirements, or the U.S. IoT Cyber Trust Mark.
• Eligibility for U.S. government security clearance.
• Familiarity with static and dynamic analysis platforms and SAST/DAST tools for firmware and embedded software.
• Experience with ML-based vulnerability detection models or AI-augmented reverse-engineering pipelines.
• Experience on small, fast-moving consulting or product-security teams.
• Comfort operating in AWS or similar cloud environments used to support analysis pipelines or customer deliverables.
• Strong attention to detail, intellectual curiosity, and ability to adjust priorities quickly in a dynamic environment.
• Interest in expanding into broader customer-facing and engineering responsibilities.

Responsibilities

• Plan and execute penetration tests of IoT, ICS/OT, and automotive targets, including connected consumer devices, industrial controllers, automotive ECUs, and telematics units.
• Own engagements largely autonomously, from scoping and attack-surface prioritization through testing, evidence collection, reporting, and debrief.
• Use Finite State platform analysis alongside hands-on testing to prioritize vulnerabilities that are reachable and exploitable on target hardware.
• Perform hardware interaction and firmware extraction using interfaces and techniques such as JTAG, SWD, UART, SPI, I2C, eMMC, NOR/SPI flash, and NAND flash dumping; solder and rework PCBs as needed to access debug interfaces.
• Reverse engineer firmware with tools such as Ghidra and Binary Ninja to identify vulnerabilities, including memory corruption, authentication bypasses, hard-coded credentials, and insecure update mechanisms.
• Assess IoT and automotive wireless protocols, including Bluetooth/BLE, Zigbee, Z-Wave, Wi-Fi, and cellular (LTE/5G).
• Assess vehicle buses such as CAN, LIN, and automotive Ethernet, and ICS/OT protocols such as Modbus, DNP3, EtherNet/IP, and OPC-UA.
• Assess standard network protocols and related attack surfaces, including exposed services, cloud and mobile companion apps, and APIs; apply standard web application testing methodology such as OWASP Top 10 where relevant.
• Review source code, primarily C and C++ and related embedded languages, to identify security weaknesses in firmware and embedded software.
• Review SBOMs and third-party and open-source components using software composition analysis to identify known vulnerabilities and license risk in customer supply chains.
• Use approved AI-powered security tooling and LLM-assisted workflows to accelerate analysis, triage, and reporting while complying with customer data-handling requirements and NDA constraints.
• Evaluate customer products against relevant regulations and standards when in scope.
• Write clear reports communicating technical findings, risk ratings, and remediation guidance to technical and executive audiences; score findings with CVSS, prioritize based on demonstrated exploitability, and support not-affected determinations with defensible VEX justifications.
• Participate in peer review of engagement deliverables as both author and reviewer.
• Support customer-facing work, including scoping calls, technical debriefs, and remediation follow-up.
• Collaborate with product, engineering, and research teams to feed engagement findings into the platform and improve detection capabilities.
• Contribute to internal knowledge sharing, tooling development, and methodology improvement.
• Participate in industry conferences, publish research, and represent Finite State externally as opportunities arise.
• Maintain awareness of evolving AI capabilities relevant to embedded security research.

Benefits

• Finite State provides and funds the role’s bench-lab equipment, including a soldering and rework station, probes, programmers, a logic analyzer, and radios, shipped to wherever the employee works.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior