Automotive Penetration Tester (Red Team)

Block Harbor Cybersecurity; United States; On-site; USD 120,000 - 190,000; Full time

Job summary

Block Harbor Cybersecurity is seeking an Automotive Penetration Tester to own the end-to-end engagement lifecycle for securing modern mobility. You will scope requirements, author proposals, and conduct hands-on assessments of embedded ECUs, telematics, and vehicle networks, combining deep vehicle knowledge with adversarial testing.

You will apply both manual techniques and automated tooling to deliver thorough, compliant vulnerability analyses for North American OEMs and tier-1 suppliers, while

Qualifications

• 3+ years of professional experience in offensive security, penetration testing, or hardware security assessment in automotive/embedded domains.
• Hands-on expertise with vehicle architectures and CAN/UDS/Automotive Ethernet.
• Familiarity with security research methodologies and automotive cybersecurity standards.

Responsibilities

• Scope customer requirements and draft test plans and proposals.
• Lead offensive security testing across vehicle interfaces (CAN, LIN, Automotive Ethernet, UDS, DoIP, Bluetooth, Wi-Fi, Web APIs).
• Reverse engineer embedded ECUs and surface vulnerabilities.
• Leverage automated and manual fuzzing to uncover zero-day issues.
• Utilize VSEC platform to manage tests and findings.
• Produce client-ready reports mapped to ISO/SAE 21434/UN R155/NIST.

Skills

Offensive security

Penetration testing

Hardware security assessment

Automotive protocols (CAN/UDS)

Tools

Wireshark

Vector CANalyzer/CANoe

Ghidra

IDA Pro

JTAG/SWD debuggers

Fuzzers

Job description

Born in Detroit with automotive expertise at our core, Block Harbor is on a mission to secure the future of mobility. Vehicles are no longer just mechanical transport - they are highly connected computers on wheels. We combine deep vehicle engineering knowledge with world-class offensive security to find and fix vulnerabilities before they ever hit the pavement. Powered by our proprietary Vehicle Security Engineering Cloud (VSEC), our award-winning Red Team rigorously tests vehicle components, systems, and cloud infrastructure for the world’s most innovative automakers and tier-1 suppliers.

The Automotive Penetration Tester owns the full engagement lifecycle: scoping customer requirements, authoring proposals, executing hands-on technical assessments, and translating findings into clear, actionable guidance. If you thrive at the intersection of deep vehicle knowledge and adversarial thinking, this role was built for you.

We believe AI and automation are reshaping how security work gets done. Candidates who actively leverage LLMs and AI tooling to sharpen efficiency and accelerate research will have a distinct advantage here.

Responsibilities

We are looking for a relentless Automotive Penetration Tester to join our Red Team. In this role, you won’t just scan for vulnerabilities - you will actively reverse engineer, fuzz, and exploit embedded ECUs, telematics units, and vehicle network architectures. You will pair manual "car hacking" grit with our automated VSEC Test platform to deliver deep, compliant vulnerability analysis to North American OEMs and suppliers. If you are a security researcher who loves pulling apart hardware, dissecting binary structures, and finding the zero-days others miss, you belong at Block Harbor.

• Customer Engagement & Scoping: Partner with customers to understand their security objectives, vehicle architectures, and compliance requirements - translating technical needs into well-defined test scopes and accurate, compelling proposals.
• Proposal Development: Author clear and thorough penetration test proposals that articulate methodology, scope, timelines, and expected deliverables. Communicate the value of Block Harbor’s approach in terms that resonate with both technical and non-technical stakeholders.
• Offensive Security Testing: Execute deep-dive, activity-based penetration tests across physical and wireless vehicle interfaces - including CAN, LIN, Automotive Ethernet, UDS, DoIP, Bluetooth, Wi-Fi, and Web APIs.
• Firmware & Software Reversing: Reverse engineer and perform binary composition analysis on embedded vehicle controllers to surface configuration flaws, logic bugs, and memory corruption vulnerabilities.
• Automated & Manual Fuzzing: Apply advanced fuzzing techniques to expose zero-day vulnerabilities and stability weaknesses in vehicle communication stacks and diagnostic services.
• VSEC Platform Utilization: Leverage Block Harbor’s VSEC platform to accelerate test execution and centralize vulnerability management - and actively contribute feedback that shapes its development.
• Reporting & Remediation Support: Produce comprehensive, client-ready penetration test reports mapped to relevant regulatory frameworks (ISO/SAE 21434, UN R155, NIST). Present findings directly to customer engineering teams, clearly communicating technical risk and prioritized mitigation strategies.
• Community & Research: Represent Block Harbor in the broader automotive security ecosystem - including ASRG, DEF CON Car Hacking Village, and SAE international committees - through ongoing threat research and thought leadership.

Required Qualifications

• Experience: 3+ years of professional experience in offensive security, penetration testing, or hardware security assessment within the automotive, embedded systems, or IoT domains.
• Protocols & Architecture: Hands-on expertise with vehicle electrical architectures (E/E) and protocols, particularly CAN/CAN-FD, UDS, and Automotive Ethernet.
• Tools of the Trade: Proficiency with hardware and network exploitation tools including Wireshark, Vector CANalyzer/CANoe, Ghidra, IDA Pro, JTAG/SWD debuggers, and software fuzzers.
• AI and LLM: Hands-on experience with AI and LLMs in a security or research context.
• Standards Knowledge: Working knowledge of automotive cybersecurity compliance frameworks, specifically ISO/SAE 21434 and UN R155.
• Mindset: A "Security-Always" ethic, sharp problem-solving instincts, and a collaborative approach that embodies our "full throttle collaboration" culture.
• Travel: Willingness to travel internationally.

Preferred / Nice-to-Have

• Experience with cloud platforms and API security
• Comfortable engaging directly with customers and presenting technical findings