[Hiring] Senior Security Penetration Tester @EPAM Systems

Role Description

We are looking for a research-minded Senior Security Penetration Tester who sits at the intersection of three disciplines: operational technology (OT/ICS) security, exploit development and zero-day discovery, and offensive testing of AI and agentic systems. This is not a scanner-driven role. You will break real industrial environments safely, write working exploits for vulnerabilities you find yourself, and attack LLM applications and autonomous agents the way a capable adversary would. You will deliver client engagements end-to-end, contribute original research to the client's zero-day program, and help build the AI-driven tooling that scales our offensive capability. The role suits someone who enjoys going deep on hard targets and can explain what they found to both engineers and executives.

Responsibilities

• Plan and execute safety-first penetration tests of OT/ICS environments (water and wastewater, energy, manufacturing, building systems), including passive asset discovery, Purdue-model segmentation testing and IT-to-OT pivot analysis.
• Assess PLCs, RTUs, HMIs, SCADA servers, historians and engineering workstations across major vendors (e.g., Rockwell/Allen-Bradley, Siemens, Schneider Electric) and SCADA platforms (e.g., VTScada, Ignition, AVEVA/Wonderware).
• Test industrial protocols such as Modbus/TCP, DNP3, EtherNet/IP/CIP, S7comm, OPC UA, BACnet and IEC 60870-5-104/61850 for authentication, integrity and logic-manipulation weaknesses.
• Build and use lab or digital-twin replicas to validate attack paths before touching production; operate strictly within client-approved rules of engagement, change windows and safety constraints.
• Map findings to ISA/IEC 62443, NIST SP 800-82 and MITRE ATT&CK for ICS, with remediation guidance that is realistic for plant operations.
• Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications and enterprise software using reverse engineering, source code review and fuzzing (coverage-guided, protocol-aware and grammar-based).
• Write reliable proof-of-concept and weaponized exploits for memory corruption (stack/heap overflows, use-after-free, type confusion), logic flaws and authentication bypass.
• Attack LLM applications and agentic AI systems, assessing how models, retrieval, tools and permissions combine to create attack surface.
• Contribute original research to the client's zero-day program and help build AI-driven tooling that scales offensive capability.
• Deliver client engagements end to end and communicate findings clearly to both engineers and executives.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Electrical/Control Engineering or a related field, or equivalent practical experience.
• 5+ years of hands-on penetration testing and offensive security experience, including significant depth in at least two of: OT/ICS security, exploit development/vulnerability research, and AI/LLM security.
• Background in OT/ICS penetration testing on real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices.
• Showcase of exploit-writing ability, evidenced by original vulnerability research such as CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results.
• Hands-on experience testing LLM applications or agentic AI systems, with an understanding of how models, retrieval, tools and permissions combine to create attack surface.
• Strong programming skills in Python and C/C++, with working knowledge of x86/x64 and ARM assembly; Bash/PowerShell required.
• Proficiency with reverse engineering and debugging tools such as IDA Pro, Ghidra and Binary Ninja, alongside WinDbg and GDB with pwndbg/GEF.
• Competency in fuzzers (AFL++, libFuzzer, boofuzz) and offensive tooling (Burp Suite, Metasploit, Nmap), as well as Wireshark with ICS dissectors and C2 frameworks such as Cobalt Strike or Sliver.
• Familiarity with industry standards and frameworks, including OWASP Top 10, CVE/CWE and OSSTMM, along with NIST, MITRE ATT&CK, ISA/IEC 62443 and MITRE ATLAS.
• Excellent written and spoken English; able to convey complex technical concepts to technical and non-technical audiences.
• Based in Europe and eligible to work through EPAM; able to overlap with US business hours for client meetings, and available for occasional travel (e.g., on-site OT assessments) when required.

Nice to have

• Knowledge of Rust or Go.
• Relevant offensive security certifications (considered a plus, not a substitute for demonstrated skill).