Senior Embedded Security Tester & Assurance Lead

Zappsec; Tewksbury, Northern (MA, KY); Hybrid; USD 150,000 - 190,000; Full time

Job summary

Zappsec seeks a Senior Product Security Consultant in the United States to lead hands-on hardware, firmware, and embedded security testing across product ecosystems, including device-level assessments and secure update reviews. You will validate exploitability, perform retesting, and produce remediation guidance, working with security architects to define test cases for IEC 62443 and related controls.

This role requires 7–10+ years in product security testing, including device-level penetration

Qualifications

• Strong hands-on penetration testing and product security assessment experience across embedded systems, connected devices, and firmware security.
• Experience with firmware extraction, unpacking, reverse engineering, binary analysis, dynamic analysis, and embedded security testing.
• Familiarity with hardware attack surfaces, embedded architectures, Linux-based systems, network protocols, and secure update mechanisms.
• Ability to assess secure boot, firmware integrity, firmware trust chain, signing, rollback protection, and update flows.

Responsibilities

• Perform hardware and device-level penetration testing.
• Conduct firmware extraction, unpacking, and binary analysis.
• Assess secure boot, firmware integrity, rollback protection, and update mechanisms.
• Evaluate exposed interfaces (USB, network, wireless, serial/debug, admin services).
• Validate authentication, authorization, encryption, and secure configuration controls.
• Conduct exploitability validation, attack-path analysis, and privilege-escalation testing.
• Analyze attack surfaces to identify security weaknesses across device components.
• Perform resilience testing and evaluate security-control effectiveness.
• Test BLE, Wi-Fi, web/API, companion apps, and proprietary protocols; perform controlled fuzzing.
• Collaborate with Security architect to identify test cases and required open-source tools for IEC 62443 and EU CRA controls.
• Lead hardware security testing and active-tools-based testing parts of engagements.

Skills

Hands-on pentesting

Embedded systems security

Firmware analysis

Reverse engineering

Exploitability validation

Attack path analysis

Security testing tools

Tools

Binwalk

Ghidra

IDA Pro

Radare2

OpenSSL

Burp Suite

Nmap

Wireshark

Frida

GDB

Job description

Zappsec seeks a Senior Product Security Consultant in the United States to lead hands-on hardware, firmware, and embedded security testing across product ecosystems, including device-level assessments and secure update reviews. You will validate exploitability, perform retesting, and produce remediation guidance, working with security architects to define test cases for IEC 62443 and related controls.

This role requires 7–10+ years in product security testing, including device-level penetration