Penetration Tester - Hardware

This remote Penetration Tester - Hardware role at Packetlabs focuses on leading security assessments of embedded and IoT devices, combining hands-on physical testing with rigorous analysis to produce credible, actionable results for clients.

Location

Florida (remote)

Salary

USD 80,000 - 120,000 per year

Role Summary

In this position, you will plan and execute end-to-end hardware penetration testing across embedded and IoT environments. Responsibilities include direct interaction with embedded hardware, firmware analysis, and examination of physical attack surfaces. You will collaborate with clients to deliver findings that improve overall security posture.

Key Responsibilities

• Plan and execute end-to-end hardware penetration tests on embedded and IoT devices, aligned to a defined scope and rules of engagement
• Identify, access, and exploit on-board debug interfaces such as JTAG, SWD, UART, and similar interfaces to gain code execution or memory access
• Extract firmware via debug ports, in-circuit flash reads (SPI / I2C / NAND), or chip-off when required, then analyze for vulnerabilities
• Intercept and analyze data on embedded buses including SPI, I2C, UART, CAN, and USB using logic analyzers and protocol decoders
• Where in scope, perform side-channel analysis and fault injection such as power analysis and voltage or clock glitching to bypass secure boot, readout protection, or authentication
• Reverse engineer firmware and embedded binaries using tools such as Ghidra, IDA, and Binwalk to identify logic flaws, hardcoded secrets, and exploitable conditions
• Assess physical attack surface, tamper resistance, and key or secret storage
• Differentiate theoretical concerns from operationally relevant risk to keep reports actionable
• Produce high-quality technical reports and present results to both technical and non-technical client stakeholders
• Advise clients on practical, prioritized remediation they can act on
• Build and maintain lab tooling, test rigs, and internal methodology
• Contribute to research, responsible disclosure, and internal knowledge-sharing
• Stay current on hardware attack techniques, embedded architectures, and defensive controls
• Help raise the standard of hardware security work across the firm

Required Education and Experience

• Graduate of an Information Security, Computer Science, or Computer/Electrical Engineering degree program (or equivalent hands-on experience)
• Strong electronics fundamentals, including the ability to read schematics and datasheets and reason about a board from them
• Hands-on soldering capability, including SMD rework and basic chip removal
• Demonstrated experience accessing debug interfaces (JTAG, SWD, UART) and extracting firmware from real devices
• Comfort using core bench instruments including a logic analyzer, oscilloscope, and multimeter
• Firmware reverse-engineering skills with scripting proficiency in Python, plus enough C to read embedded code
• Familiarity with embedded architectures including ARM/Cortex-M, MIPS, AVR, and RISC-V, as well as RTOS and bare-metal concepts
• Clear written and verbal communication

Technologies

• JTAG, SWD, UART, SPI, I2C, NAND, CAN, USB
• Logic analyzers, protocol decoders
• Ghidra, IDA, Binwalk
• Python, C
• ARM/Cortex-M, MIPS, AVR, RISC-V
• RTOS, bare-metal
• KiCad, Altium
• ChipWhisperer, SDR, BLE, Wi-Fi

Benefits

• Immediate and ongoing offensive security training, mentorship, and professional development
• Competitive compensation and growth opportunity
• Paid education and professional development reimbursement to support continued learning, certifications, and technical growth
• Flexible work environment
• Paid volunteer day each year
• Paid Birthday day off
• Paid U.S. public holidays
• Fully remote within Texas or Florida

Location Requirement

• You must be located in Texas or Florida

Nice to Have

• Side-channel or fault-injection experience (for example, ChipWhisperer)
• RF and wireless work, including SDR, BLE, sub-GHz, or Wi-Fi
• Knowledge of secure boot chains, TEEs, secure elements, and HSMs
• PCB design familiarity (KiCad / Altium) for understanding target boards
• Published CVEs, conference talks, CTF placements, or open-source tooling
• Relevant certifications (for example, OSCP for breadth, or hardware-focused training)

What Success Looks Like

• Clients gain a clear, accurate understanding of hardware risk with proven, reproducible impact
• Findings are credible and actionable for both technical and leadership audiences
• Engagements are delivered at a consistently high standard with strong client confidence
• Scope and rules of engagement are managed well as engagements evolve, with risk surfaced early and clearly
• Packetlabs' hardware testing methodology and lab capability continue to mature through your contribution
• Clients trust Packetlabs as the partner that can break hardware before others do