Embedded Security Testing

Embedded + Security:

1. Job Description:

We are seeking an experienced Penetration Tester - Leader to perform offensive security testing on embedded devices (automotive or medical device or Iot) , network devices, network IT/OT infrastructure & backend/cloud applications. The role involves identifying security vulnerabilities through manual and automated penetration testing, reverse engineering in compliance with industry-specific cybersecurity standards (Automotive, Healthcare, OT, IT) and project requirements.

Key Responsibilities:

1. Perform Threat analysis and risk assessment

2. Conduct security assessments on:

3. Embedded/ IOT devices

4. Cloud/Web apps

5. IT/OT infrastructure

6. Android & iOS apps

7. Perform firmware extraction, analysis, and reverse engineering

8. Identify, exploit, and document vulnerabilities with clear risk and remediation guidance

9. Collaborate with development and system teams to validate fixes and retest vulnerabilities

10. Prepare penetration test reports for customers and internal stakeholders

11. Knowledge of secure coding flaws

Technical Skills:

1. Strong hands-on experience in penetration testing methodologies

2. Proficiency with Kali Linux and Linux-based testing environments

3. Hands-on usage of tools such as:

4. Burp Suite

5. Metasploit

6. Nmap

7. Wireshark

8. Ghidra / IDA Pro

9. Experience in reverse engineering of embedded firmware (ARM, PowerPC, TriCore, etc.)

10. Familiarity with bootloaders, secure boot, and firmware update mechanisms

11. Understanding of hardware attack surfaces and mitigation techniques

Tools & Platforms:

1. Kali Linux, Ubuntu, embedded Linux
2. Burp Suite, Wireshark, Nmap, Metasploit
3. Ghidra, IDA Pro, Binwalk
4. Python / Bash scripting for automation (preferred)

Certifications (Preferred):

Demonstrate strong offensive security capabilities supported by industryrecognized certifications and verifiable achievements, including:

1. Proven presence in leading Security Hall of Fame / Acknowledgment Lists from global technology vendors (e.g. Bugcrowd, HackerOne).

2. Preferred certifications are

3. CREST Certified Tester (CCT / CRT / CCT-INF)

4. OSCP / OSWE / GWAPT

5. Offensive Security or INE/eLearnSecurity certifications, such as: OSEP, ejpt, eCPPT, eWPT/eWPTX, eCPTX

6. Documented contribution to the cybersecurity community through published CVEs listed under the candidates name. Participation in responsible disclosure programs with publicly available acknowledgements or awards.

7. Demonstrated excellence through participation in national and international cybersecurity hackathons and completion of advanced CTF challenges. Achieved toptier rankings on offensivetraining platforms such as Hack The Box, TryHackMe, and other similar competitive environments.

8. Strong portfolio of security research, exploit development, vulnerability analysis, or open-source security tool contributions.

Standards & Framework Awareness:

1. OWASP Testing Methodology
2. Familiarity with Threat Analysis and Risk Assessment and threat-based testing

Behavioral & Professional Skills:

1. Strong analytical and problem-solving skills
2. Ability to think like an attacker and communicate risk clearly
3. Excellent technical documentation and reporting skills
4. Comfortable with customer-facing discussions and technical reviews
5. Ability to work independently and in cross-functional teams Under direct supervision, performs maintenance on existing software products for customers. Assists in coding, testing, and debugging new software or making enhancements to existing software for customers. Writes programs according to specifications from higher level staff or business analysts. May use CASE tools. Makes suggestions for problem solutions or software enhancements. May assist in development of user manuals. Works with technical staff to learn and understand problems with software. Note: If the incumbent is responsible for the development of software for internal use, please match to a position in the Application Development sub-family grouping.