Skip To Main Content
epam-logo-black.svgepam-logo-black.svg
backBack to Search

Senior Security Penetration Tester

Remote in Poland
Security.Testing& 7 others
Looking for something else?

Find a vacancy that works for you. Send us your CV to receive a personalized offer.

Find me a job

We are looking for a research-minded Senior Security Penetration Tester who sits at the intersection of three disciplines: operational technology (OT/ICS) security, exploit development and zero-day discovery, and offensive testing of AI and agentic systems.

This is not a scanner-driven role. You will break real industrial environments safely, write working exploits for vulnerabilities you find yourself, and attack LLM applications and autonomous agents the way a capable adversary would. You will deliver client engagements end-to-end, contribute original research to the client's zero-day program, and help build the AI-driven tooling that scales our offensive capability.

The role suits someone who enjoys going deep on hard targets and can explain what they found to both engineers and executives.

Responsibilities
  • Plan and execute safety-first penetration tests of OT/ICS environments (water and wastewater, energy, manufacturing, building systems), including passive asset discovery, Purdue-model segmentation testing and IT-to-OT pivot analysis
  • Assess PLCs, RTUs, HMIs, SCADA servers, historians and engineering workstations across major vendors (e.g., Rockwell/Allen-Bradley, Siemens, Schneider Electric) and SCADA platforms (e.g., VTScada, Ignition, AVEVA/Wonderware)
  • Test industrial protocols such as Modbus/TCP, DNP3, EtherNet/IP/CIP, S7comm, OPC UA, BACnet and IEC 60870-5-104/61850 for authentication, integrity and logic-manipulation weaknesses
  • Build and use lab or digital-twin replicas to validate attack paths before touching production; operate strictly within client-approved rules of engagement, change windows and safety constraints
  • Map findings to ISA/IEC 62443, NIST SP 800-82 and MITRE ATT&CK for ICS, with remediation guidance that is realistic for plant operations
  • Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications and enterprise software using reverse engineering, source code review and fuzzing (coverage-guided, protocol-aware and grammar-based)
  • Write reliable proof-of-concept and weaponized exploits for memory corruption (stack/heap overflows, use-after-free, type confusion), logic flaws and authentication bypass
  • Attack LLM applications and agentic AI systems, assessing how models, retrieval, tools and permissions combine to create attack surface
  • Contribute original research to the client's zero-day program and help build AI-driven tooling that scales offensive capability
  • Deliver client engagements end to end and communicate findings clearly to both engineers and executives
Requirements
  • Bachelor's degree in Computer Science, Information Security, Electrical/Control Engineering or a related field, or equivalent practical experience
  • 5+ years of hands-on penetration testing and offensive security experience, including significant depth in at least two of: OT/ICS security, exploit development/vulnerability research, and AI/LLM security
  • Background in OT/ICS penetration testing on real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices
  • Showcase of exploit-writing ability, evidenced by original vulnerability research such as CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results
  • Hands-on experience testing LLM applications or agentic AI systems, with an understanding of how models, retrieval, tools and permissions combine to create attack surface
  • Strong programming skills in Python and C/C++, with working knowledge of x86/x64 and ARM assembly; Bash/PowerShell required
  • Proficiency with reverse engineering and debugging tools such as IDA Pro, Ghidra and Binary Ninja, alongside WinDbg and GDB with pwndbg/GEF
  • Competency in fuzzers (AFL++, libFuzzer, boofuzz) and offensive tooling (Burp Suite, Metasploit, Nmap), as well as Wireshark with ICS dissectors and C2 frameworks such as Cobalt Strike or Sliver
  • Familiarity with industry standards and frameworks, including OWASP Top 10, CVE/CWE and OSSTMM, along with NIST, MITRE ATT&CK, ISA/IEC 62443 and MITRE ATLAS
  • Excellent written and spoken English; able to convey complex technical concepts to technical and non-technical audiences
  • Based in Europe and eligible to work through EPAM; able to overlap with US business hours for client meetings, and available for occasional travel (e.g., on-site OT assessments) when required
Nice to have
  • Knowledge of Rust or Go
  • Relevant offensive security certifications (considered a plus, not a substitute for demonstrated skill)