Senior Security Penetration Tester
E
EPAM SystemsOT/ICS security
Based in Europe; opportunity to work remotely within Poland, Able to overlap with US business hours for client meetingsFull-TimeSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Languages
- Excellent written and spoken English
- Experience
- 5+ years of hands-on penetration testing and offensive security experience
- Required Skills
- Python
Requirements
- Hold a bachelor’s degree in Computer Science, Information Security, Electrical/Control Engineering or a related field, or have equivalent practical experience.
- Have 5+ years of hands-on penetration testing and offensive security experience.
- Bring significant depth in at least two of OT/ICS security, exploit development/vulnerability research, and AI/LLM security.
- Have OT/ICS penetration testing experience in real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing.
- Demonstrate exploit-writing ability through original vulnerability research, such as CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results.
- Have hands-on experience testing LLM applications or agentic AI systems.
- Have strong Python and C/C++ programming skills, working knowledge of x86/x64 and ARM assembly, and Bash/PowerShell skills.
- Be proficient with reverse-engineering and debugging tools such as IDA Pro, Ghidra, Binary Ninja, WinDbg and GDB with pwndbg/GEF.
- Have experience with fuzzers such as AFL++, libFuzzer or boofuzz, and offensive tools including Burp Suite, Metasploit and Nmap.
- Be familiar with Wireshark ICS dissectors, C2 frameworks such as Cobalt Strike or Sliver, and relevant security standards and frameworks.
- Have excellent written and spoken English and be able to explain complex technical concepts to technical and non-technical audiences.
- Be based in Europe, eligible to work through EPAM, able to overlap with US business hours for client meetings, and available for occasional travel when required.
Responsibilities
- Plan and execute safety-first penetration tests of OT/ICS environments, including passive asset discovery, Purdue-model segmentation testing and IT-to-OT pivot analysis.
- Assess industrial control devices, SCADA platforms and engineering workstations across major vendors.
- Test industrial protocols for authentication, integrity and logic-manipulation weaknesses.
- Build and use lab or digital-twin replicas to validate attack paths before production testing.
- Map findings to ISA/IEC 62443, NIST SP 800-82 and MITRE ATT&CK for ICS, and provide operationally realistic remediation guidance.
- Research vulnerabilities in binaries, firmware, embedded/IoT devices, web applications and enterprise software using reverse engineering, source code review and fuzzing.
- Develop proof-of-concept and weaponized exploits for memory corruption, logic flaws and authentication bypass.
- Assess LLM applications and agentic AI systems, including risks involving models, retrieval, tools and permissions.
- Contribute original research to the client’s zero-day program and help build AI-driven offensive tooling.
- Deliver client engagements end to end and communicate findings to technical and non-technical audiences.
View Full Description & ApplyYou'll be redirected to the employer's site
