Senior Engineer - Penetration Testing (Embedded Security)

Location: Remote in the United States or Canada; the detailed role requirements specify U.S. work authorization without sponsorship. Limited travel is required for occasional customer-site assessments, conferences, and team gatherings. The role is not tied to a company site.

Company

hirify.global provides a firmware analysis and product security platform that helps organizations detect vulnerabilities, manage software supply chain risks, and secure connected devices and embedded systems.

What you will do

• Plan and execute penetration tests against IoT, embedded, ICS/OT, and automotive targets.
• Own engagements from scoping and attack-surface prioritization through testing, evidence collection, reporting, debriefs, and remediation follow-up.
• Perform hardware interaction, firmware extraction, PCB soldering and rework, firmware reverse engineering, and source code review.
• Assess wireless protocols, vehicle buses, industrial control protocols, network services, cloud APIs, mobile applications, and companion attack surfaces.
• Review SBOMs and open-source components, evaluate compliance requirements, and use CVSS and VEX to prioritize and justify findings.
• Collaborate with product, engineering, and research teams on platform improvements, tooling, methodology, and security research.

Requirements

• 7+ years of hands-on experience in IoT, embedded, ICS/OT, or automotive security, with experience owning engagements autonomously.
• Deep expertise in at least one target domain and working familiarity with the other two.
• Experience with JTAG, SWD, SPI, I2C, UART, flash-memory extraction, PCB soldering, and hardware-level security assessments.
• Proficiency with Ghidra and/or Binary Ninja, reverse engineering across embedded architectures, and source-code review in C and C++.
• Experience assessing wireless, automotive, or industrial control protocols, plus web and mobile application testing methodology.
• Ability to produce clear technical reports, communicate findings to technical and executive audiences, use Python and Bash, and work with SBOM, CVSS, and VEX concepts.

Nice to have

• Automotive security, OBD-II, ECU, V2X, automotive HSM, or ICS/SCADA assessment experience.
• CVE or responsible-disclosure history, exploit development, or vulnerability research.
• OSCP, OSWE, GPEN, GICSP, or relevant automotive security credentials.
• Experience with security regulations and standards, AI-augmented reverse engineering, SAST/DAST, AWS, or vulnerability-detection models.

Culture & Benefits

• Fully distributed, remote-first work environment.
• hirify.global ships and funds a bench lab with soldering, probing, programming, analysis, and radio equipment.
• Work follows customer safety procedures and written rules of engagement; production OT is never tested without authorization.
• Opportunities to contribute to conferences, research, internal knowledge sharing, tooling, and methodology development.
• Some customer data and hardware may be subject to U.S. export controls; restricted engagements are identified explicitly.