Remote FTTH Security Specialist | Telecom Pentest

P1 Security; United States; Remote; USD 120.000 - 190.000; Vollzeit

Zusammenfassung

P1 Security is a fully remote company specializing in securing critical telecom networks for clients across the globe. We seek experienced professionals with hands‑on telecom network security expertise, especially in FTTH, 5G and OpenRAN environments, to join our security practice and drive offensive testing programs.

You will perform authorized penetration tests on FTTH/PON infrastructure, dive into GPON/NG-PON2 internals, reverse‑engineer CPEs and gateways, and map risk paths using MITRE and

Qualifikationen

• MANDATORY: Experience in security audit pentests on OT and IT infrastructure.
• Experience with vendor ecosystems such as Huawei, ZTE, Nokia, Ericsson, Calix, or Adtran FTTH equipment.
• Familiarity with telecom security standards and frameworks: 3GPP SCAS, GSMA NESAS, ISO/IEC 27001, NIST CSF, and ITU‑T/BBF specifications.
• Experience in red teaming or adversary emulation against critical infrastructure.
• Relevant certifications, such as:
• OSCP / OSEP / OSWE / OSED
• GPEN / GXPN / GRID
• CEH (Practical), eJPT/eCPPT, or CRTO
• Telecom‑specific training (GSMA, Black Hat/DEF CON telecom or hardware trainings)
• Published research, CVEs, conference talks, or bug bounty history in telecom or embedded devices.

Aufgaben

• Audits — you will plan and run scoped, authorized penetration tests of FTTH/PON infrastructure: OLTs, ONTs/ONUs, the management systems around the ODN, and customer premises equipment.
• PON internals — you will dig into GPON, XG-PON, XGS-PON and NG-PON2: OMCI, PLOAM, and how ONTs are authenticated and provisioned.
• CPE and gateways — you will take them apart: firmware extraction and reverse engineering, exposed debug interfaces (UART/JTAG), hardcoded credentials, update mechanisms and web/CLI management flaws.
• Subscribers at scale — you will look at what provisions and manages them (TR-069/CWMP, TR-369/USP, ACS/OSS/BSS integrations, zero-touch provisioning) and at the subscriber‑facing edge: BNG/BRAS, PPPoE/IPoE, DHCP, RADIUS/AAA, VLAN segmentation, QoS and isolation between subscribers.
• Convergence and infrastructure — you will follow fixed–mobile convergence (5G FWA, shared core, shared OSS/BSS, unified identity and billing) and review devices and management planes (routers, switches, aggregation equipment, NMS/EMS, SNMP, NETCONF/YANG, SSH/Telnet, APIs, privileged access) against vendor and industry hardening baselines.
• Threat modeling — you will map attack paths for real operator environments using frameworks such as MITRE ATT&CK, the GSMA FASG/FS.xx guidance and the MITRE FiGHT knowledge base.
• Findings and clients — you will turn all of this into clear, prioritized reports with proof‑of‑concept evidence, risk ratings and actionable remediation, present them to stakeholders, and support remediation verification and retesting.
• The team — you will contribute to our internal tooling, test methodologies, lab environments and reusable attack playbooks.

Kenntnisse

Security audit pentests

Red teaming

Telecom security standards

Vendor ecosystems familiarity

Adversary emulation

Embedded device security

Jobbeschreibung

P1 Security is a fully remote company specializing in securing critical telecom networks for clients across the globe. We seek experienced professionals with hands‑on telecom network security expertise, especially in FTTH, 5G and OpenRAN environments, to join our security practice and drive offensive testing programs.

You will perform authorized penetration tests on FTTH/PON infrastructure, dive into GPON/NG-PON2 internals, reverse‑engineer CPEs and gateways, and map risk paths using MITRE and