FTTH Security Expert

P1 Security; Paris; Remote; EUR 90,000 - 130,000; Full time

Job summary

P1 Security is seeking an experienced security professional with deep telecom security expertise to perform audits, red teaming and vulnerability assessments across FTTH/PON networks and related infrastructure. You will analyze GPON/XG-PON/NG-PON2, CPEs and management interfaces, while evaluating provisioning systems and edge services.

Remote-friendly with a Paris headquarters, the role involves generating actionable reports, supporting remediation, and contributing to internal tooling and

Qualifications

• Deep knowledge on Fixed-line network architecture (FTTx, DSL, Coaxial).
• MANDATORY: Experience in security audit pentests on OT and IT infrastructure.
• Experience with vendor ecosystems such as Huawei, ZTE, Nokia, Ericsson, Calix, or Adtran FTTH equipment.
• Familiarity with telecom security standards and frameworks: 3GPP SCAS, GSMA NESAS, ISO/IEC 27001, NIST CSF, and ITU‑T/BBF specifications.
• Experience in red teaming or adversary emulation against critical infrastructure.
• Certifications such as: OSCP / OSEP / OSWE / OSED; GPEN / GXPN / GRID; CEH (Practical), eJPT/eCPPT, or CRTO.
• Telecom‑specific training (GSMA, Black Hat/DEF CON telecom or hardware trainings).
• Published research, CVEs, conference talks, or bug bounty history in telecom or embedded devices.

Responsibilities

• Audits — plan and run scoped, authorized penetration tests of FTTH/PON infrastructure: OLTs, ONTs/ONUs, the management systems around the ODN, and customer premises equipment.
• PON internals — dig into GPON, XG-PON, XGS-PON and NG-PON2: OMCI, PLOAM, and how ONTs are authenticated and provisioned.
• CPE and gateways — firmware extraction and reverse engineering, exposed debug interfaces (UART/JTAG), hardcoded credentials, update mechanisms and web/CLI management flaws.
• Subscribers at scale — look at provisioning and management (TR-069/CWMP, TR-369/USP, ACS/OSS/BSS integrations, zero‑touch provisioning) and at the subscriber‑facing edge: BNG/BRAS, PPPoE/IPoE, DHCP, RADIUS/AAA, VLAN segmentation, QoS and isolation between subscribers.
• Convergence and infrastructure — review fixed–mobile convergence (5G FWA, shared core, shared OSS/BSS, unified identity and billing) and review devices and management planes (routers, switches, aggregation equipment, NMS/EMS, SNMP, NETCONF/YANG, SSH/Telnet, APIs, privileged access) against vendor and industry hardening baselines.
• Threat modeling — map attack paths for real operator environments using MITRE ATT&CK, the GSMA FASG/FS.xx guidance and the MITRE FiGHT knowledge base.
• Findings and clients — turn all of this into clear, prioritized reports with proof‑of‑concept evidence, risk ratings and actionable remediation, present them to stakeholders, and support remediation verification and retesting.
• The team — you will contribute to our internal tooling, test methodologies, lab environments and reusable attack playbooks.

Skills

FTTx knowledge

Security tests

OT/IT pentest

Red teaming

Vendor equipment

Telecom security standards

Security certifications

Bug bounty/ research

Job description

About P1 Security

Founded in 2011 by serial entrepreneur and security expert Philippe Langlois, P1 Security is on a mission to secure critical and sovereign mobile networks by providing services and technologies to identify, detect and recover from critical threats and vulnerabilities.

P1 Security is one of the very few companies in the world tackling telecom security through pure Mobile and Telecom Security attacks and security from 5G and Cloud-based infrastructure Security, OpenRAN, Network Slicing and RAN Sharing, Edge Computing (MEC), down to legacy 2/3/4G Diameter, SS7 SIGTRAN attacks, GTP manipulation and fuzzing.

Our offering and expertise range from Network and Telecom Core Network Security, Intrusion Detection and Vulnerability Assessment solutions, with technology backed by more than a decade of engineering research. We are a lean scale-up, engaged in emerging markets (Eastern Europe, Middle East, Asia), Europe and North America.

The P1 Security team includes experts from telecom operators and security companies as well as renowned security researchers who regularly present unique P1 Security research at leading international security conferences & GSMA working groups. P1 Labs, the R&D branch of P1 Security, shares Open Source initiatives with the telecom security community (www.github.com/P1sec/).

We are growing the team with people who want to help write it. We are looking for experienced profiles with grounded, hands‑on knowledge of telecom networks — and a real appetite for FTTx technologies in particular. Curious, creative and open‑minded people who want to dig deep into a genuinely sovereign topic: the security of the mobile networks our connectivity runs on.

Job Description

If your years have been spent in FTTx — access networks, PON, CPE, provisioning, field operations — and security has always been the question you kept coming back to, talk to us. The role described below does not really exist as a box to tick yet: we care far more about the person than about an exact match with a job title. Bring the part of the picture you know best, and we will build the rest together.

What you will do

• Audits — you will plan and run scoped, authorized penetration tests of FTTH/PON infrastructure: OLTs, ONTs/ONUs, the management systems around the ODN, and customer premises equipment.

• PON internals — you will dig into GPON, XG-PON, XGS-PON and NG-PON2: OMCI, PLOAM, and how ONTs are authenticated and provisioned.

• CPE and gateways — you will take them apart: firmware extraction and reverse engineering, exposed debug interfaces (UART/JTAG), hardcoded credentials, update mechanisms and web/CLI management flaws.

• Subscribers at scale — you will look at what provisions and manages them (TR-069/CWMP, TR-369/USP, ACS/OSS/BSS integrations, zero‑touch provisioning) and at the subscriber‑facing edge: BNG/BRAS, PPPoE/IPoE, DHCP, RADIUS/AAA, VLAN segmentation, QoS and isolation between subscribers.

• Convergence and infrastructure — you will follow fixed–mobile convergence (5G FWA, shared core, shared OSS/BSS, unified identity and billing) and review devices and management planes (routers, switches, aggregation equipment, NMS/EMS, SNMP, NETCONF/YANG, SSH/Telnet, APIs, privileged access) against vendor and industry hardening baselines.

• Threat modeling — you will map attack paths for real operator environments using frameworks such as MITRE ATT&CK, the GSMA FASG/FS.xx guidance and the MITRE FiGHT knowledge base.

• Findings and clients — you will turn all of this into clear, prioritized reports with proof‑of‑concept evidence, risk ratings and actionable remediation, present them to stakeholders, and support remediation verification and retesting.

• The team — you will contribute to our internal tooling, test methodologies, lab environments and reusable attack playbooks.

Preferred Qualifications

• Deep knowledge on Fixed‑line network architecture (FTTx, DSL, Coaxial)

• MANDATORY: Experience in security audit pentests on OT and IT infrastructure

• Experience with vendor ecosystems such as Huawei, ZTE, Nokia, Ericsson, Calix, or Adtran FTTH equipment.

• Familiarity with telecom security standards and frameworks: 3GPP SCAS, GSMA NESAS, ISO/IEC 27001, NIST CSF, and ITU‑T/BBF specifications.

• Experience in red teaming or adversary emulation against critical infrastructure.

• Relevant certifications, such as:

• OSCP / OSEP / OSWE / OSED

• GPEN / GXPN / GRID

• CEH (Practical), eJPT/eCPPT, or CRTO

• Telecom‑specific training (GSMA, Black Hat/DEF CON telecom or hardware trainings)

• Published research, CVEs, conference talks, or bug bounty history in telecom or embedded devices.

Language requirements

• English - fluent speaker

• French - optional

Further details

• Headquarters: Fully remote company, with headquarters in Paris - FRANCE

• Remote policy:

• At P1 Security, we recognize the importance of work‑life balance, and that's why our remote policy is a key part of our company culture. We understand that flexibility is crucial, allowing our team members to work remotely while achieving their personal and professional goals. To keep our team connected, we schedule monthly meetups with department members and gather the entire team on‑site every two months. These regular touch points ensure effective communication, collaboration, and a dynamic team spirit, reflecting the dynamic and adaptable spirit of P1 Security. We believe in the power of flexible work arrangements to bring out the best in our team, driving success in a way that suits everyone's unique lifestyle

Hiring process

• First contact call (10-20min)

• Direct manager call (30min)

• Capability assessment exercice (depending on position)

• C‑level & Director call (30 min)

Specialisations

Telecommunications Security, SS7, SIGTRAN, LTE, IMS, UMTS, CDMA, GPRS, OpenStack, Kubernetes, LinuxServers / PNF, Diameter, NFV, Security, VoLTE, VoWifi, GTP, Diameter, 3G, 4G, IoT Security, NFV(i), S1AP, X2AP, Fuzzing, eUTRAN S1AP, X2AP, NgRAN, NGAP, PFCP, 5GC SBI