SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Finite State is seeking an experienced Senior Engineer – Penetration Testing to join its Offensive Security team. The role focuses on hands-on hardware and software penetration testing of connected devices, embedded systems, industrial control systems, and automotive platforms for enterprise customers. You will combine deep hardware and firmware expertise with a consultative approach to deliver clear, actionable findings that help manufacturers and operators understand and reduce risk.
Core responsibilities include planning and executing penetration tests against IoT, ICS/OT, and automotive targets; owning engagements autonomously from scoping through reporting and customer debrief. You will use Finite State's firmware analysis platform alongside your own testing to focus effort on vulnerabilities that are genuinely reachable and exploitable. Key technical activities include hardware interaction and firmware extraction using JTAG, SWD, UART, SPI, I2C, and flash dumping techniques; PCB soldering and rework as needed; firmware reverse engineering using Ghidra and Binary Ninja; assessment of wireless protocols (Bluetooth/BLE, Zigbee, Z-Wave, Wi-Fi, cellular); vehicle buses (CAN, LIN, automotive Ethernet); and industrial control protocols (Modbus, DNP3, EtherNet/IP, OPC-UA). You will also perform source code review in C/C++, SBOM review and software composition analysis, and produce high-quality written reports that communicate findings and remediation guidance to technical and executive audiences using CVSS scoring and VEX justification.
Beyond delivery, you will collaborate with product and engineering teams to feed findings back into the platform, contribute to internal knowledge sharing and tooling development, and represent Finite State at conferences and in published research. The role is fully remote with occasional travel for customer-site assessments, conferences, and team gatherings. Finite State provides and funds a complete bench lab setup (soldering station, probes, programmers, logic analyzer, radios) shipped to your location.
Qualifications: Bachelor's degree in Computer Science, Electrical Engineering, Computer Engineering, or related field (or equivalent hands-on experience), plus 7+ years of hands-on experience in IoT, embedded, ICS/OT, or automotive security with a track record of owning engagements autonomously at a senior level. Hands-on depth in at least one of the three target domains (IoT/embedded, ICS/OT, or automotive) plus working familiarity with the other two. Demonstrated experience performing hardware-level security assessments including JTAG/SWD debugging, SPI/I2C/UART communication, and flash memory extraction; comfort soldering and reworking PCBs to reach debug interfaces. Proficiency with Ghidra and/or Binary Ninja for firmware reverse engineering; ability to analyze ARM, MIPS, PPC, RISC-V, x86, and x64 architectures. Experience testing wireless protocols and either vehicle buses or industrial control protocols. Working familiarity with standard network protocols and web/mobile application testing methodology. Ability to read and review source code in C and C++ to identify memory safety and authentication flaws. Familiarity with SBOM concepts and formats (CycloneDX, SPDX). Working fluency with CVSS scoring and VEX. Ability to map findings to relevant regulatory or standards frameworks. Excellent written and verbal communication skills with proven ability to write clear technical reports and present to diverse audiences. Experience with Python and Bash scripting for automation. Familiarity with AI-assisted security tooling and interest in applying LLM-based workflows.
Preferred qualifications include hands-on automotive security experience (OBD-II, ECU flashing, V2X, automotive HSM); ICS/SCADA security assessment experience; CVE or responsible disclosure history; relevant certifications (OSCP, OSWE, GPEN, GICSP, or automotive security credentials); knowledge of regulations and standards (CRA, CE RED, UNECE WP.29, IEC 62443, FDA, IoT Cyber Trust Mark); U.S. government security clearance eligibility; familiarity with static/dynamic analysis and SAST/DAST tooling; experience with ML-based vulnerability detection; background on small, fast-moving consulting or product security teams; comfort with AWS or similar cloud environments; and interest in expanding into broader customer-facing and engineering responsibilities.
