Senior Engineer – Penetration Testing

Job not on LinkedIn

🔥 2 hours ago

🇺🇸 United States – Remote

⏰ Full Time

🟠 Senior

🧑‍💻 Full-stack Engineer

👻 Ghost score 15%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Finite State

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2017

🏥 Healthcare

🍽️ Food & Beverage

🏭 Manufacturing

Healthcare • Food & Beverage • Manufacturing

Finite State is a leading provider of comprehensive software risk management solutions, focused on securing digital assets and enhancing the security of connected devices across various industries. Their platform is designed to address the unique challenges of device security, such as long lifecycles, complex supply chains, and vendor transparency issues. Finite State offers solutions for software supply chain security, SBOM management, incident response, and vulnerability management, helping organizations adhere to cyber compliance and manage risk effectively. With capabilities to scan source code, binaries, and third-party components, Finite State delivers unmatched visibility and protection for a wide range of connected devices, including those in automotive, medical, industrial, energy, and government sectors.

📋 Description

• Plan and execute penetration tests against IoT, ICS/OT, and automotive targets • Own engagements including scoping, attack-surface prioritization, testing, evidence collection, reporting, and debriefing • Use Finite State’s platform analysis alongside hands-on testing to identify genuinely reachable and exploitable vulnerabilities • Perform hardware interaction and firmware extraction using JTAG, SWD, UART, SPI, I2C, eMMC, NOR/SPI flash, and NAND flash techniques • Solder and rework PCBs to access debug interfaces • Conduct firmware reverse engineering with Ghidra and Binary Ninja • Assess wireless protocols, vehicle buses, industrial-control protocols, network protocols, cloud and mobile companion apps, and APIs • Perform source-code review in C, C++, and related embedded languages • Review third-party and open-source components through SBOM review and software composition analysis • Use approved AI-powered security tooling and LLM-assisted workflows for analysis, triage, and reporting • Evaluate products against relevant regulations and standards • Produce reports with technical findings, risk ratings, remediation guidance, CVSS scores, exploitability prioritization, and VEX justifications • Participate in peer review of engagement deliverables • Support customer scoping calls, technical debriefs, and remediation follow-up • Collaborate with product, engineering, and research teams to improve platform detection capabilities • Contribute to knowledge sharing, tooling development, and methodology improvement

🎯 Requirements

• Bachelor's degree in Computer Science, Electrical Engineering, Computer Engineering, or related field, or equivalent hands-on experience • 7+ years of hands-on experience in IoT, embedded, ICS/OT, or automotive security • Track record of owning engagements autonomously at a senior level • Hands-on depth in at least one target domain: IoT/embedded, ICS/OT, or automotive; working familiarity with the other two • Experience with JTAG/SWD debugging, SPI/I2C/UART communication, and flash memory extraction • Comfort soldering and reworking PCBs to reach debug interfaces • Proficiency with Ghidra and/or Binary Ninja • Ability to analyze ARM, MIPS, PPC, RISC-V, x86, and x64 architectures • Experience testing BLE, Zigbee, Z-Wave, Wi-Fi, and cellular protocols • Experience with vehicle buses or industrial control protocols including CAN, LIN, automotive Ethernet, Modbus, DNP3, EtherNet/IP, or OPC-UA • Familiarity with network protocols and web/mobile application testing methodology • Ability to review C and C++ source code for security weaknesses • Familiarity with SBOM concepts and CycloneDX/SPDX formats • Working fluency with CVSS scoring and VEX • Ability to map findings to a relevant regulatory or standards framework • Excellent written and verbal communication skills and technical reporting ability • Experience with Python and Bash scripting and automation • Familiarity with AI-assisted security tooling and LLM-based workflows • Must be authorized to work in the U.S. without sponsorship • Some engagements require eligibility as a U.S. person under ITAR/EAR rules

🏖️ Benefits

• Fully distributed workforce and remote-first culture • Remote work with no relocation required • Limited travel, including occasional trips for customer-site assessments, conferences, and team gatherings • Finite State ships and funds a bench lab with soldering and rework station, probes, programmers, logic analyzer, and radios • Opportunities for platform integrations, direct account ownership, and building business-driving tools • Opportunities to participate in industry conferences, publish research, and represent Finite State externally • Equal employment opportunity and reasonable accommodations for applicants with physical and mental disabilities

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume