Automotive/Embedded Penetration Tester (Cybersecurity V&V)

Acesoft Labs; Bengaluru; Hybrid; INR 1,500,000 - 2,300,000; Full time

Job summary

Acesoft Labs in Bengaluru, India, is seeking an experienced automotive security tester to conduct penetration testing across vehicle, ECU, and component levels, including embedded systems and wireless interfaces. The role involves simulating real-world attack scenarios, documenting findings, and collaborating with internal teams and external suppliers.

Candidates should have 4+ years in automotive pentesting, strong knowledge of AUTOSAR, QNX, Linux, and programming in C or CAPL, plus scripting

Qualifications

• Bachelor's/Master's in a relevant engineering or cybersecurity field.
• Minimum 4 years of hands-on automotive penetration testing experience.
• Strong knowledge of ECU architecture and automotive cybersecurity principles.
• Proficiency in reverse engineering firmware using tools like Ghidra or IDA Pro.
• Experience with safety/standards such as ISO/SAE 21434, UNECE R155, AIS 189, and GB 44495.

Responsibilities

• Conduct penetration testing at vehicle, ECU, and component levels.
• Document findings with risk assessments and evidence.
• Collaborate with internal teams and external suppliers to implement security measures.
• Perform manual security code reviews for embedded and connected systems.
• Occasionally test web, API, and mobile applications.

Skills

Automotive penetration testing

ECU architecture

Embedded systems

C, CAPL

Python scripting

Test automation

Stakeholder management

Technical writing

Education

Electrical/Electronics Engineering or Embedded Systems or Cybersecurity degree

Tools

Ghidra

IDA Pro

CANoe

vFlash

CANoe.DiVA

JTAG/UART

Job description

Job Description

This role involves conducting and facilitating penetration testing at the vehicle, component, and functional levels. The candidate will simulate real-world attack scenarios targeting embedded systems, automotive interfaces, wireless protocols, and connected services.

Key Responsibilities

• Contribute to the development and continuous improvement of Cybersecurity Verification & Validation (V&V) activities.
• Define, tailor, and execute/facilitate grey-box and black-box penetration testing at ECU, functional, and vehicle levels.
• Conduct fuzz testing on automotive interfaces and services to uncover unknown vulnerabilities.
• Demonstrate compliance with automotive cybersecurity standards and regulations such as ISO/SAE 21434, UNECE R155, AIS 189, and GB 44495.
• Perform penetration testing in both lab and on-site environments, with flexibility for travel.
• Perform manual security code reviews to identify vulnerabilities in embedded software and connected systems.
• Document test findings with detailed risk assessments and technical evidence
• Share with internal and external teams recommendations on security hardening measures
• Onboard and collaborate with competent external suppliers
• Occasionally conduct penetration testing of web applications, APIs, and mobile applications

Required Qualifications

• Bachelors or Masters degree in Electrical/Electronics Engineering, Embedded Systems, Cybersecurity or a related field.
• Minimum 4 years of hands-on experience in automotive penetration testing, with 79 years of total experience in embedded systems or broader penetration testing domains.
• Strong understanding of vehicle and ECU architecture, and automotive cybersecurity principles.
• Familiarity with microcontroller platforms and software architectures (e.g., AUTOSAR, QNX, Linux, Android).
• Proficiency in programming (C, CAPL etc.) and scripting (Python, Bash) for test automation.
• Experience with automotive cybersecurity testing frameworks and tools.
• Hands-on security testing experience with:
  • Hardware-level and its interface testing (e.g., MCU, HSM, eMMC, JTAG, UART, Fault injection, Side Channel etc.)
  • Automotive interface/protocols (e.g., OBD, UDS, CAN, Ethernet)
  • Wireless (e.g., Bluetooth, Wi-Fi, Cellular/SDR -4G/5G etc.)
  • Connected Systems (Web/Mobile app, Server, APIs, Cloud etc.)
  • Vehicle and ECU security features (e.g., secure communication, secure OTA, secure boot, secure diagnostics, firewall, IDS, logging etc.)
  • Fuzz testing tools and techniques for automotive systems
• Proficiency in reverse engineering firmware using tools like Ghidra or IDA Pro.
• Experience with restbus simulation, flashing toolchains, and diagnostic tools (e.g., CANoe, vFlash, CANoe.DiVA).
• Experience conducting manual security code reviews for embedded and connected system software.
• Strong documentation, communication, and presentation skills.
• Strong skills in documenting work, communicating clearly, and presenting technical topics to varied audiences.
• Proven stakeholder management skills, including cross-functional collaboration with engineering, compliance, and supplier teams.

Nice-to-Have

• Industry certifications such as OSCP, OSCE, GIAC GPEN, or equivalent.

Preferred Candidate