EPAM Systems

Senior Security Penetration Tester

Brak informacji o wynagrodzeniu

SeniorZdalnie·WrocławFull-time

#476084·Dodano 8 dni temu·1

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Exploit DevelopmentOT SecurityICS securitypenetration testingVulnerability ResearchPythonReverse engineeringC C++Fuzzing

Podsumowanie oferty

Senior Security Penetration Tester conducting offensive assessments of OT/ICS environments, researching vulnerabilities and developing exploits, and testing LLM applications and agentic AI systems. The role includes end-to-end client engagements, original zero-day research, and building AI-driven offensive tooling.

Wymagania

Bachelor's degree in Computer Science, Information Security, Electrical/Control Engineering, or a related field, or equivalent practical experience.
5+ years of hands-on penetration testing and offensive security experience, with significant depth in at least two of OT/ICS security, exploit development/vulnerability research, and AI/LLM security.
Background in OT/ICS penetration testing in real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices.
Demonstrated exploit-writing ability, evidenced by original vulnerability research such as CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results.
Hands-on experience testing LLM applications or agentic AI systems, and understanding of how models, retrieval, tools, and permissions combine to create attack surfaces.
Strong programming skills in Python and C/C++, working knowledge of x86/x64 and ARM assembly, and Bash/PowerShell.
Proficiency with reverse-engineering and debugging tools such as IDA Pro, Ghidra, Binary Ninja, WinDbg, and GDB with pwndbg/GEF.
Competency with fuzzers (AFL++, libFuzzer, boofuzz) and offensive tooling (Burp Suite, Metasploit, Nmap), as well as Wireshark with ICS dissectors and C2 frameworks such as Cobalt Strike or Sliver.
Familiarity with industry standards and frameworks including OWASP Top 10, CVE/CWE, OSSTMM, NIST, MITRE ATT&CK, ISA/IEC 62443, and MITRE ATLAS.
Excellent written and spoken English; able to convey complex technical concepts to technical and non-technical audiences.
Nice to have:
- Knowledge of Rust or Go.
- Relevant offensive security certifications.

Obowiązki

Plan and execute safety-first penetration tests of OT/ICS environments, including passive asset discovery, Purdue-model segmentation testing, and IT-to-OT pivot analysis.
Assess PLCs, RTUs, HMIs, SCADA servers, historians, engineering workstations, and platforms from vendors including Rockwell/Allen-Bradley, Siemens, Schneider Electric, VTScada, Ignition, and AVEVA/Wonderware.
Test industrial protocols including Modbus/TCP, DNP3, EtherNet/IP/CIP, S7comm, OPC UA, BACnet, and IEC 60870-5-104/61850 for authentication, integrity, and logic-manipulation weaknesses.
Build and use lab or digital-twin replicas to validate attack paths; follow client-approved rules of engagement, change windows, and safety constraints.
Map findings to ISA/IEC 62443, NIST SP 800-82, and MITRE ATT&CK for ICS, and provide remediation guidance suited to plant operations.
Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications, and enterprise software using reverse engineering, source code review, and fuzzing.
Write proof-of-concept and weaponized exploits for memory corruption, logic flaws, and authentication bypass.
Attack LLM applications and agentic AI systems, assessing how models, retrieval, tools, and permissions combine to create attack surfaces.
Contribute original research to the client's zero-day program and help build AI-driven tooling to scale offensive capability.
Deliver client engagements end to end and communicate findings to engineers and executives.

Benefity

Career development programs.
Thought leadership, mentoring, soft-skills, and well-being programs.
Certification opportunities covering Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Participation in the Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, Multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Offices with entertainment and relaxation zones, table tennis, football, free snacks, and coffee.
Corporate, social, and well-being events.
Business-driven relocation opportunities.

Pakiet relokacyjny

Kursy językowe

Udziały pracownicze

Ubezpieczenie

Karta sportowa

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Candidates must be based in Europe and eligible to work through EPAM.
Must be able to overlap with US business hours for client meetings.
Occasional travel, such as for on-site OT assessments, may be required.

EPAM Systems

1770 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz