We are seeking a research-minded Senior Security Tester who sits at the intersection of three disciplines: operational technology (OT/ICS) security, exploit development and zero-day discovery, and offensive testing of AI and agentic systems. This is not a scanner-driven role — you will break real industrial environments safely, write working exploits for vulnerabilities you find yourself, and attack LLM applications and autonomous agents the way a capable adversary would. You will deliver client engagements end-to-end, contribute original research to the customer's zero-day program, and help build the AI-driven tooling that scales our offensive capability. Responsibilities Plan and execute safety-first penetration tests of OT/ICS environments (water and wastewater, energy, manufacturing, building systems), including passive asset discovery, Purdue-model segmentation testing and IT-to-OT pivot analysis Assess PLCs, RTUs, HMIs, SCADA servers, historians and engineering workstations across major vendors and SCADA platforms Test industrial protocols such as Modbus/TCP, DNP3, EtherNet/IP/CIP, S7comm, OPC UA, BACnet and IEC 60870-5-104/61850 for authentication, integrity and logic-manipulation weaknesses Build and use lab or digital-twin replicas to validate attack paths before touching production, and operate strictly within client-approved rules of engagement, change windows and safety constraints Map findings to ISA/IEC 62443, NIST SP 800-82 and MITRE ATT&CK for ICS, with remediation guidance that is realistic for plant operations Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications and enterprise software using reverse engineering, source code review and fuzzing Write reliable proof-of-concept and weaponized exploits for memory corruption, logic flaws and authentication bypasses Deliver client engagements end to end and communicate findings clearly to both engineers and executives Requirements Minimum 5 years of hands-on penetration testing and offensive security experience, including significant depth in at least two of: OT/ICS security, exploit development/vulnerability research, and AI/LLM security Demonstrated OT/ICS penetration testing experience on real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices Showcase of original vulnerability research through CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results Hands-on experience testing LLM applications or agentic AI systems, with a working understanding of how models, retrieval, tools and permissions combine to create attack surface Proficiency in Python, C/C++, x86/x64 and ARM assembly, and Bash/PowerShell; Rust or Go a plus Proficiency with reverse engineering and debugging tools (IDA Pro, Ghidra, Binary Ninja), fuzzers (AFL++, libFuzzer, boofuzz) and offensive tooling (Burp Suite, Metasploit, Nmap) Familiarity with industry standards and frameworks including OWASP Top 10, CVE/CWE, OSSTMM, NIST, MITRE ATT&CK, ISA/IEC 62443 and MITRE ATLAS Bachelor's degree in Computer Science, Information Security, Electrical/Control Engineering or a related field or equivalent practical experience Excellent written and spoken English, with the ability to convey complex technical concepts to technical and non-technical audiences Based in Europe and eligible to work through EPAM, able to overlap with US business hours for client meetings, and available for occasional travel when required
