Senior Engineer - Penetration Testing

Finite State is seeking an experienced Senior Engineer - Penetration Testing to join its growing Offensive Security team. The role focuses on hands-on hardware and software penetration tests of connected devices, embedded systems, industrial control systems, and automotive platforms on behalf of customers, combining deep hardware and firmware expertise with a consultative mindset to deliver clear, actionable findings. The core mandate is hands-on penetration testing, with potential future opportunities to expand into platform integrations, direct account ownership, and building tools that drive the business. This is a remote role in the United States with no relocation required; candidates must be authorized to work in the U.S. without sponsorship. Some customer hardware and technical data is subject to U.S. export control (ITAR/EAR), and a subset of engagements is restricted to U.S. persons.

Responsibilities

Plan and execute penetration tests against IoT, ICS/OT, and automotive targets; own engagements largely autonomously, including scoping, prioritizing attack surfaces, testing, evidence, reporting, and debrief; use Finite State's platform analysis alongside own testing to focus on reachable and exploitable vulnerabilities; perform hardware interaction and firmware extraction (JTAG, SWD, UART, SPI, I2C, eMMC, NOR/SPI and NAND flash dumping) and solder/rework PCBs as needed; conduct firmware reverse engineering with Ghidra and Binary Ninja; assess wireless protocols, vehicle buses, and industrial control protocols; assess network protocols, cloud and mobile companion apps and APIs; perform source code review primarily in C, C++, and embedded languages; review third-party and open-source components via SBOM review and software composition analysis; use approved AI-powered and LLM-assisted tooling while honoring customer data-handling and NDA constraints; evaluate products for compliance with relevant regulations and standards; produce high-quality reports with CVSS scoring, prioritization by demonstrated exploitability, and VEX justifications; participate in peer review of deliverables; support customer-facing scoping calls, debriefs, and remediation follow-up; collaborate with product, engineering, and research teams to feed findings back into the platform; contribute to knowledge sharing, tooling development, and methodology improvement; participate in conferences and publish research

Requirements

Bachelor's degree in Computer Science, Electrical Engineering, Computer Engineering, or a related field (or equivalent hands-on experience); 7+ years of hands-on experience in IoT, embedded, ICS/OT, or automotive security; track record of owning engagements autonomously at a senior level; hands-on depth in at least one of IoT/embedded, ICS/OT, or automotive, plus working familiarity with the other two; demonstrated hardware-level security assessment experience (JTAG/SWD debugging, SPI/I2C/UART communication, flash memory extraction); comfort soldering and reworking PCBs to reach debug interfaces; proficiency with Ghidra and/or Binary Ninja; ability to analyze ARM, MIPS, PPC, RISC-V, x86, and x64 architectures; experience testing wireless protocols (BLE, Zigbee, Z-Wave, Wi-Fi, cellular) and either vehicle buses (CAN, LIN, automotive Ethernet) or industrial control protocols (Modbus, DNP3, EtherNet/IP, OPC-UA); working familiarity with standard network protocols and web/mobile application testing methodology; ability to read and review C and C++ source code for security issues; familiarity with SBOM concepts and formats (CycloneDX, SPDX); working fluency with CVSS scoring and VEX; ability to map findings to at least one regulatory or standards framework; excellent written and verbal communication skills; experience with Python and Bash scripting and automation; U.S. work authorization without sponsorship

Nice to have

Hands-on automotive security experience (OBD-II assessment, ECU flashing and analysis, V2X protocols, automotive HSM evaluation); experience with ICS/SCADA security assessments; CVE or responsible disclosure history or other exploit development/vulnerability research; relevant certifications (OSCP, OSWE, GPEN, GICSP, or vendor-specific automotive security credentials); working knowledge of regulations and standards (EU CRA, CE RED / EN 303 645, UNECE WP.29 / ISO 21434, IEC 62443, FDA premarket cybersecurity requirements, US IoT Cyber Trust Mark); U.S. government security clearance eligibility; familiarity with static and dynamic analysis platforms and SAST/DAST tooling for firmware; experience with ML-based vulnerability detection or AI-augmented reverse engineering; experience on small, fast-moving consulting or product security teams; comfort with AWS or similar cloud environments; strong attention to detail and intellectual curiosity; interest in expanding into customer-facing and engineering responsibilities

Benefits

Finite State ships and funds the bench lab equipment (soldering and rework station, probes, programmers, logic analyzer, radios) to wherever you work; fully distributed, remote-first culture; limited travel for customer-site assessments, conferences, and team gatherings