penetration tester in OT/ICS and AI security

EPAM; United States; Remote; USD 140,000 - 220,000; Full time

Job summary

EPAM is seeking a Senior Offensive Security Engineer focusing on operational technology security, exploit development, and AI/agentic systems testing. You will lead end-to-end client engagements, contribute to zero-day research programs, and develop AI-driven tooling to scale offensive capabilities.

The role requires hands-on OT/ICS testing in industrial environments, proficiency in reverse engineering and fuzzing, and deep knowledge of ISA/IEC 62443, MITRE ATT&CK for IC.

Qualifications

• Bachelor’s degree or equivalent practical experience in a relevant field.
• 5+ years of hands-on penetration testing and offensive security experience.
• Experience with OT/ICS security testing in real industrial environments or labs.

Responsibilities

• Plan and perform safety-first OT/ICS penetration tests across water, energy, manufacturing, and building systems.
• Assess PLCs, RTUs, HMIs, SCADA servers, historians, and workstations across major vendors.
• Test industrial protocols for authentication, integrity, and logic weaknesses.
• Create lab or digital-twin replicas to validate attack paths before production tests.
• Map findings to ISA/IEC 62443, NIST SP 800-82, MITRE ATT&CK for IC; provide remediation guidance.
• Write proof-of-concept exploits and research vulnerabilities; reverse engineer binaries/firmware.

Skills

OT/ICS security

Exploit development

AI/LLM security

Python

C/C++

Reverse engineering

Fuzzing

Binary analysis

Network security testing

Engagement delivery

Education

Bachelor's degree in Computer Science or related field

Tools

IDA Pro

Ghidra

WinDbg

GDB

Burp Suite

Metasploit

Nmap

Wireshark

Cobalt Strike

Sliver

Job description

Описание

The role focuses on operational technology security, exploit development and zero-day discovery, and offensive testing of AI and agentic systems. It delivers end-to-end client engagements, contributes original research to clients’ zero-day programs, and develops AI-driven tooling to scale offensive capabilities.

Задачи

• Plan and execute safety-first penetration tests of OT/ICS environments, including water and wastewater, energy, manufacturing, and building systems
• Assess PLCs, RTUs, HMIs, SCADA servers, historians, and engineering workstations across major vendors and SCADA platforms
• Test industrial protocols for authentication, integrity, and logic-manipulation weaknesses
• Build and use lab or digital-twin replicas to validate attack paths before testing production environments
• Map findings to ISA/IEC 62443, NIST SP 800-82, and MITRE ATT&CK for IC, and provide remediation guidance suited to plant operations
• Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications, and enterprise software using reverse engineering, source code review, and fuzzing
• Write reliable proof-of-concept and weaponized exploits for memory corruption, logic flaws, and authentication bypass
• Attack LLM applications and agentic AI systems, assessing how models, retrieval, tools, and permissions combine to create attack surfaces
• Contribute original research to the client’s zero-day program and help build AI-driven tooling that scales offensive capabilities
• Deliver client engagements end to end and communicate findings clearly to engineers and executives

Требования

• Bachelor’s degree in Computer Science, Information Security, Electrical/Control Engineering, or a related field, or equivalent practical experience
• 5+ Years of hands-on penetration testing and offensive security experience, with significant depth in at least two of OT/ICS security, exploit development/vulnerability research, and AI/LLM security
• Background in OT/ICS penetration testing in real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices
• Demonstrated exploit-writing ability through original vulnerability research, such as CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results
• Hands-on experience testing LLM applications or agentic AI systems, and understanding of how models, retrieval, tools, and permissions combine to create attack surfaces
• Strong Python and C/C++ programming skills, working knowledge of x86/x64 and ARM assembly, and Bash/PowerShell
• Proficiency with reverse engineering and debugging tools such as IDA Pro, Ghidra, Binary Ninja, WinDbg, and GDB with pwndbg/GEF
• Competency with fuzzers such as AFL++, libFuzzer, and boofuzz; offensive tools such as Burp Suite, Metasploit, and Nmap; Wireshark with IC? and C2 frameworks such as Cobalt Strike or Sliver
• Familiarity with OWASP Top 10, CVE/CWE, OSSTMM, NIST, MITRE ATT&CK, ISA/IEC 62443, and MITRE ATLAS
• Excellent written and spoken English, with the ability to explain complex technical concepts to technical and non-technical audiences
• Based in Europe and eligible to work through EPAM; able to overlap with US business hours for client meetings and available for occasional travel when required
• Будет плюсом: Rust or Go, relevant offensive security certifications (a plus, not a substitute for demonstrated skill)

Условия

• Occasional travel may be required for on-site OT assessments