FTTH Security Architect & Penetration Expert

P1 Security; Paris; Remote; EUR 90,000 - 130,000; Full time

Job summary

P1 Security is seeking an experienced security professional with deep telecom security expertise to perform audits, red teaming and vulnerability assessments across FTTH/PON networks and related infrastructure. You will analyze GPON/XG-PON/NG-PON2, CPEs and management interfaces, while evaluating provisioning systems and edge services.

Remote-friendly with a Paris headquarters, the role involves generating actionable reports, supporting remediation, and contributing to internal tooling and

Qualifications

• Deep knowledge on Fixed-line network architecture (FTTx, DSL, Coaxial).
• MANDATORY: Experience in security audit pentests on OT and IT infrastructure.
• Experience with vendor ecosystems such as Huawei, ZTE, Nokia, Ericsson, Calix, or Adtran FTTH equipment.
• Familiarity with telecom security standards and frameworks: 3GPP SCAS, GSMA NESAS, ISO/IEC 27001, NIST CSF, and ITU‑T/BBF specifications.
• Experience in red teaming or adversary emulation against critical infrastructure.
• Certifications such as: OSCP / OSEP / OSWE / OSED; GPEN / GXPN / GRID; CEH (Practical), eJPT/eCPPT, or CRTO.
• Telecom‑specific training (GSMA, Black Hat/DEF CON telecom or hardware trainings).
• Published research, CVEs, conference talks, or bug bounty history in telecom or embedded devices.

Responsibilities

• Audits — plan and run scoped, authorized penetration tests of FTTH/PON infrastructure: OLTs, ONTs/ONUs, the management systems around the ODN, and customer premises equipment.
• PON internals — dig into GPON, XG-PON, XGS-PON and NG-PON2: OMCI, PLOAM, and how ONTs are authenticated and provisioned.
• CPE and gateways — firmware extraction and reverse engineering, exposed debug interfaces (UART/JTAG), hardcoded credentials, update mechanisms and web/CLI management flaws.
• Subscribers at scale — look at provisioning and management (TR-069/CWMP, TR-369/USP, ACS/OSS/BSS integrations, zero‑touch provisioning) and at the subscriber‑facing edge: BNG/BRAS, PPPoE/IPoE, DHCP, RADIUS/AAA, VLAN segmentation, QoS and isolation between subscribers.
• Convergence and infrastructure — review fixed–mobile convergence (5G FWA, shared core, shared OSS/BSS, unified identity and billing) and review devices and management planes (routers, switches, aggregation equipment, NMS/EMS, SNMP, NETCONF/YANG, SSH/Telnet, APIs, privileged access) against vendor and industry hardening baselines.
• Threat modeling — map attack paths for real operator environments using MITRE ATT&CK, the GSMA FASG/FS.xx guidance and the MITRE FiGHT knowledge base.
• Findings and clients — turn all of this into clear, prioritized reports with proof‑of‑concept evidence, risk ratings and actionable remediation, present them to stakeholders, and support remediation verification and retesting.
• The team — you will contribute to our internal tooling, test methodologies, lab environments and reusable attack playbooks.

Skills

FTTx knowledge

Security tests

OT/IT pentest

Red teaming

Vendor equipment

Telecom security standards

Security certifications

Bug bounty/ research

Job description

P1 Security is seeking an experienced security professional with deep telecom security expertise to perform audits, red teaming and vulnerability assessments across FTTH/PON networks and related infrastructure. You will analyze GPON/XG-PON/NG-PON2, CPEs and management interfaces, while evaluating provisioning systems and edge services.

Remote-friendly with a Paris headquarters, the role involves generating actionable reports, supporting remediation, and contributing to internal tooling and