Finite State - Senior Engineer

• Bachelor's degree in Computer Science, Electrical Engineering, Computer Engineering, or a related field (or equivalent hands-on experience), plus 7+ years of hands-on experience in IoT, embedded, ICS/OT, or automotive security, with a track record of owning engagements autonomously at a senior level. • 7+ years • Hands-on depth in at least one of our three target domains - IoT/embedded, ICS/OT, or automotive - plus working familiarity with the other two. We staff engagements across all three; we do not expect equal mastery of all three. • at least one • Demonstrated experience performing hardware-level security assessments: JTAG/SWD debugging, SPI/I2C/UART communication, and flash memory extraction. Comfort soldering and reworking PCBs to reach a debug interface is expected; fine-pitch and BGA rework is a plus, not a gate. • Proficiency with firmware reverse engineering tools, specifically Ghidra and/or Binary Ninja; ability to analyze ARM, MIPS, PPC, RISC-V, x86, and x64 architectures. • Experience testing wireless protocols (BLE, Zigbee, Z-Wave, Wi-Fi, cellular) and either vehicle buses (CAN, LIN, automotive Ethernet) or industrial control protocols (Modbus, DNP3, EtherNet/IP, OPC-UA) — consistent with depth in one target domain and familiarity with the others. • Working familiarity with standard network protocols and web/mobile application testing methodology - many IoT and automotive targets ship with companion apps and cloud APIs that are part of the real attack surface. • Ability to read and review source code in C and C++ to identify memory safety issues, authentication flaws, and other security weaknesses in embedded software. • Familiarity with SBOM concepts, formats (CycloneDX, SPDX), and the use of SBOMs in vulnerability management. • Working fluency with CVSS scoring and VEX, including how an exploitability determination is defended to a customer. • Ability to map findings to at least one relevant regulatory or standards framework and explain the implications to a customer. Breadth across frameworks is a plus, not a requirement. • Excellent written and verbal communication skills; proven ability to write clear, well-structured technical reports and present findings to diverse audiences. • Experience with scripting and automation using Python and Bash to support tooling and workflow efficiency. • Familiarity with AI-assisted security tooling and an interest in applying LLM-based workflows to accelerate security analysis and reporting. • Hands-on automotive security experience: OBD-II assessment, ECU flashing and analysis, V2X protocols, or automotive HSM evaluation. • Experience with industrial control system (ICS/SCADA) security assessments and familiarity with protocols such as Modbus, DNP3, EtherNet/IP, or OPC-UA. • CVE or responsible disclosure history, or other demonstrated exploit development / vulnerability research - valuable but understood to often be scarce or NDA-restricted; not a gating requirement. • Relevant certifications a plus, not required: Offensive Security (OSCP, OSWE) or SANS/GIAC (GPEN, GICSP), or vendor-specific automotive security credentials. • Working knowledge of specific regulations and standards - a subset is plenty, not comprehensive mastery: EU Cyber Resilience Act (CRA), CE RED / EN 303 645, UNECE WP.29 / ISO 21434 (automotive), IEC 62443, FDA premarket cybersecurity requirements, or the US IoT Cyber Trust Mark. • Eligibility for U.S. government security clearance - a plus for accounts with federal/defense exposure, but not a requirement and should not disqualify strong candidates otherwise. • Familiarity with static and dynamic analysis platforms and SAST/DAST tooling in the context of firmware and embedded software. • Experience with ML-based vulnerability detection models or AI-augmented reverse engineering pipelines. • Experience working on small, fast-moving consulting or product security teams. • Comfort operating in AWS or similar cloud environments used to support analysis pipelines or customer deliverables. • Strong attention to detail, intellectual curiosity, and the ability to adjust priorities quickly in a dynamic environment. • Interest in expanding into broader customer-facing and engineering responsibilities. • Working Conditions • This is a hands-on hardware role. You will work in a bench lab environment with soldering and rework equipment, and occasionally on customer sites where live industrial or medical equipment is present - engagements in those environments follow customer safety procedures and agreed rules of engagement, and testing against production OT is never performed without written authorization. Some customer hardware and technical data is subject to U.S. export control (ITAR/EAR), and a subset of engagements is restricted to U.S. persons as those rules define the term. Baseline eligibility for this role is U.S. work authorization without sponsorship; the export-restricted subset is a portion of the work, not the whole role, and we will be explicit about which accounts it affects. • At Finite State, we're on a mission to secure the connected world. Our platform empowers product security teams to detect vulnerabilities, manage software supply chain risks, and ensure compliance across complex device ecosystems. From IoT to critical infrastructure, we provide unparalleled visibility into firmware and software components, helping organizations protect their products and customers. • We move with urgency and intent — we’re transparent, own outcomes, put customers first, speak up, and learn fast — turning evidence into action. CLARITY is how we move fast without breaking trust. • C - Customer first - Learn from customers. Ship with urgency. • L - Leverage - Outsource the routine. Own the result. • A - Agency - We take responsibility—end to end. • R - Results - Ship value. Improve fast. • I - Integrity - Speak up. Experiment boldly. Be kind. • T - Transparency - Clear context. Faster decisions. • Y - "Why" - Our mission—securing the connected products humanity depends on—is the reason Finite State exists. CLARITY is how we make that mission real, every day, at speed • Bold Innovation – We push boundaries, explore new ideas, and take initiative to solve complex problems. • The Finite State platform brings visibility and control to the supply chains that create connected devices and embedded systems—all in a simple to use platform and at the scale manufacturers need to keep device production on time and on budget. After unpacking and analyzing every file, configuration, and setting in a firmware build, the platform generates a complete bill of materials for software components, identifies known and 0-day vulnerabilities, shows a contextual risk score, and provides actionable insights that product teams can use to secure their software • We are proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. Finite State is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities.