Senior Security Tester (Penetration Testing)

We are seeking a research-minded Senior Security Tester who sits at the intersection of three disciplines: operational technology (OT/ICS) security, exploit development and zero-day discovery, and offensive testing of AI and agentic systems. This is not a scanner-driven role — you will break real industrial environments safely, write working exploits for vulnerabilities you find yourself, and attack LLM applications and autonomous agents the way a capable adversary would. You will deliver client engagements end-to-end, contribute original research to the customer's zero-day program, and help build the AI-driven tooling that scales our offensive capability.

Responsibilities

• Plan and execute safety-first penetration tests of OT/ICS environments (water and wastewater, energy, manufacturing, building systems), including passive asset discovery, Purdue-model segmentation testing and IT-to-OT pivot analysis
• Assess PLCs, RTUs, HMIs, SCADA servers, historians and engineering workstations across major vendors and SCADA platforms
• Test industrial protocols such as Modbus/TCP, DNP3, EtherNet/IP/CIP, S7comm, OPC UA, BACnet and IEC 60870-5-104/61850 for authentication, integrity and logic-manipulation weaknesses
• Build and use lab or digital-twin replicas to validate attack paths before touching production, and operate strictly within client-approved rules of engagement, change windows and safety constraints
• Map findings to ISA/IEC 62443, NIST SP 800-82 and MITRE ATT&CK for ICS, with remediation guidance that is realistic for plant operations
• Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications and enterprise software using reverse engineering, source code review and fuzzing
• Write reliable proof-of-concept and weaponized exploits for memory corruption, logic flaws and authentication bypasses
• Deliver client engagements end to end and communicate findings clearly to both engineers and executives

Requirements

• Minimum 5 years of hands-on penetration testing and offensive security experience, including significant depth in at least two of: OT/ICS security, exploit development/vulnerability research, and AI/LLM security
• Demonstrated OT/ICS penetration testing experience on real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices
• Showcase of original vulnerability research through CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results
• Hands-on experience testing LLM applications or agentic AI systems, with a working understanding of how models, retrieval, tools and permissions combine to create attack surface
• Proficiency in Python, C/C++, x86/x64 and ARM assembly, and Bash/PowerShell; Rust or Go a plus
• Proficiency with reverse engineering and debugging tools (IDA Pro, Ghidra, Binary Ninja), fuzzers (AFL++, libFuzzer, boofuzz) and offensive tooling (Burp Suite, Metasploit, Nmap)
• Familiarity with industry standards and frameworks including OWASP Top 10, CVE/CWE, OSSTMM, NIST, MITRE ATT&CK, ISA/IEC 62443 and MITRE ATLAS
• Bachelor's degree in Computer Science, Information Security, Electrical/Control Engineering or a related field or equivalent practical experience
• Excellent written and spoken English, with the ability to convey complex technical concepts to technical and non-technical audiences
• Based in Europe and eligible to work through EPAM, able to overlap with US business hours for client meetings, and available for occasional travel when required

We offer

CONTINUOUS UPSKILLING, LEARNING & DEVELOPMENT

• Diversity of tasks and projects
• Assessment center for objective review of competency level
• Personal development plan
• Mentoring programs and leadership development
• Certification and professional development support 
• Access to learning platforms including more than 2,500 internal courses
• English courses taught by certified teachers

CORPORATE BENEFITS

• Extra leave days
• Referral bonuses

COMPENSATION PACKAGE

• Competitive compensation paid in USD
• Regular salary and performance reviews

MEDICAL & HEALTHCARE

• Private health insurance
• Well-being events

WORKING ENVIRONMENT

• Recreation areas and kitchens
• Tea, coffee and snacks
• Sports equipment and game consoles
• IT Equipment
• Microsoft’s Software Assurance Home Use Program (HUP)

Please note that our Talent Attraction Team reviews applications and CVs submitted in English.

EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.

Remote in Türkiye