Skip To Main Content
epam-logo-black.svgepam-logo-black.svg
backBack to Search

Senior Security Tester (Penetration Testing)

Remote in Türkiye
Security.Testing& 7 others
Looking for something else?

Find a vacancy that works for you. Send us your CV to receive a personalized offer.

Find me a job

We are seeking a research-minded Senior Security Tester who sits at the intersection of three disciplines: operational technology (OT/ICS) security, exploit development and zero-day discovery, and offensive testing of AI and agentic systems. This is not a scanner-driven role — you will break real industrial environments safely, write working exploits for vulnerabilities you find yourself, and attack LLM applications and autonomous agents the way a capable adversary would. You will deliver client engagements end-to-end, contribute original research to the customer's zero-day program, and help build the AI-driven tooling that scales our offensive capability.

Responsibilities
  • Plan and execute safety-first penetration tests of OT/ICS environments (water and wastewater, energy, manufacturing, building systems), including passive asset discovery, Purdue-model segmentation testing and IT-to-OT pivot analysis
  • Assess PLCs, RTUs, HMIs, SCADA servers, historians and engineering workstations across major vendors and SCADA platforms
  • Test industrial protocols such as Modbus/TCP, DNP3, EtherNet/IP/CIP, S7comm, OPC UA, BACnet and IEC 60870-5-104/61850 for authentication, integrity and logic-manipulation weaknesses
  • Build and use lab or digital-twin replicas to validate attack paths before touching production, and operate strictly within client-approved rules of engagement, change windows and safety constraints
  • Map findings to ISA/IEC 62443, NIST SP 800-82 and MITRE ATT&CK for ICS, with remediation guidance that is realistic for plant operations
  • Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications and enterprise software using reverse engineering, source code review and fuzzing
  • Write reliable proof-of-concept and weaponized exploits for memory corruption, logic flaws and authentication bypasses
  • Deliver client engagements end to end and communicate findings clearly to both engineers and executives
Requirements
  • Minimum 5 years of hands-on penetration testing and offensive security experience, including significant depth in at least two of: OT/ICS security, exploit development/vulnerability research, and AI/LLM security
  • Demonstrated OT/ICS penetration testing experience on real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices
  • Showcase of original vulnerability research through CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results
  • Hands-on experience testing LLM applications or agentic AI systems, with a working understanding of how models, retrieval, tools and permissions combine to create attack surface
  • Proficiency in Python, C/C++, x86/x64 and ARM assembly, and Bash/PowerShell; Rust or Go a plus
  • Proficiency with reverse engineering and debugging tools (IDA Pro, Ghidra, Binary Ninja), fuzzers (AFL++, libFuzzer, boofuzz) and offensive tooling (Burp Suite, Metasploit, Nmap)
  • Familiarity with industry standards and frameworks including OWASP Top 10, CVE/CWE, OSSTMM, NIST, MITRE ATT&CK, ISA/IEC 62443 and MITRE ATLAS
  • Bachelor's degree in Computer Science, Information Security, Electrical/Control Engineering or a related field or equivalent practical experience
  • Excellent written and spoken English, with the ability to convey complex technical concepts to technical and non-technical audiences
  • Based in Europe and eligible to work through EPAM, able to overlap with US business hours for client meetings, and available for occasional travel when required