penetration tester in OT/ICS and AI security

The role focuses on operational technology security, exploit development and zero-day discovery, and offensive testing of AI and agentic systems. It delivers end-to-end client engagements, contributes original research to clients’ zero-day programs, and develops AI-driven tooling to scale offensive capabilities.

• Plan and execute safety-first penetration tests of OT/ICS environments, including water and wastewater, energy, manufacturing, and building systems
• Assess PLCs, RTUs, HMIs, SCADA servers, historians, and engineering workstations across major vendors and SCADA platforms
• Test industrial protocols for authentication, integrity, and logic-manipulation weaknesses
• Build and use lab or digital-twin replicas to validate attack paths before testing production environments
• Map findings to ISA/IEC 62443, NIST SP 800-82, and MITRE ATT&CK for ICS, and provide remediation guidance suited to plant operations
• Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications, and enterprise software using reverse engineering, source code review, and fuzzing
• Write reliable proof-of-concept and weaponized exploits for memory corruption, logic flaws, and authentication bypass
• Attack LLM applications and agentic AI systems, assessing how models, retrieval, tools, and permissions combine to create attack surfaces
• Contribute original research to the client’s zero-day program and help build AI-driven tooling that scales offensive capabilities
• Deliver client engagements end to end and communicate findings clearly to engineers and executives

• Bachelor’s degree in Computer Science, Information Security, Electrical/Control Engineering, or a related field, or equivalent practical experience
• 5+ Years of hands-on penetration testing and offensive security experience, with significant depth in at least two of OT/ICS security, exploit development/vulnerability research, and AI/LLM security
• Background in OT/ICS penetration testing in real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices
• Demonstrated exploit-writing ability through original vulnerability research, such as CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results
• Hands-on experience testing LLM applications or agentic AI systems, and understanding of how models, retrieval, tools, and permissions combine to create attack surfaces
• Strong Python and C/C++ programming skills, working knowledge of x86/x64 and ARM assembly, and Bash/PowerShell
• Proficiency with reverse engineering and debugging tools such as IDA Pro, Ghidra, Binary Ninja, WinDbg, and GDB with pwndbg/GEF
• Competency with fuzzers such as AFL++, libFuzzer, and boofuzz; offensive tools such as Burp Suite, Metasploit, and Nmap; Wireshark with ICS dissectors; and C2 frameworks such as Cobalt Strike or Sliver
• Familiarity with OWASP Top 10, CVE/CWE, OSSTMM, NIST, MITRE ATT&CK, ISA/IEC 62443, and MITRE ATLAS
• Excellent written and spoken English, with the ability to explain complex technical concepts to technical and non-technical audiences
• Based in Europe and eligible to work through EPAM; able to overlap with US business hours for client meetings and available for occasional travel when required
• Будет плюсом: Rust or Go, relevant offensive security certifications (a plus, not a substitute for demonstrated skill)

• Occasional travel may be required for on-site OT assessments