Senior Security Consultant, Embedded SystemsThe Embedded Device Security Consultant is responsible for performing high end security evaluations and research focusing on embedded devices, including automobiles, payment devices, mobile phones, medical devices, etc. The consultant will work with other team members to deliver high quality results to IOActive's clients around the world.The consultant is expected to maintain a high level of expertise regarding known threats and technical advances in embedded security and should be particularly experienced in areas such as C, Java, assembly languages, Open Platform, and EMV standards, and cryptography.Job ResponsibilitiesThe Embedded Device Security Consultant will undertake security evaluation tasks and duties in order to meet customer requirements and project deadlines. The tasks may include:Investigate possible logical attack scenarios by interpreting the code review findings, orienting the attack paths, and analyzing the test resultsDevelop sophisticated, state-of-the-art attacks that integrate the latest attack methods against embedded productsCreate tools to assist in project goalsCommunicate complex vulnerabilities to both technical and non-technical client staffPerform research on new attack vectors, discover new vulnerabilities, create new exploitation techniquesEvangelize IOActive Labs through blogs, white papers, presentations, etc.Support business development efforts through the scoping of engagementsJob RequirementsTechnical SkillsAbility to connect and use JTAG/Onchip DebuggersSoldering skills to remove flash chips and solder on test leadsReverse Engineering, specifically FirmwareKnowledge of ARM and other embedded microprocessorsKnowledge of Linux and other embedded OSsProficient in at least one mainstream programming language (Java, .NET or C/C++)Hardware/embedded system hackingDevelopment experience in software on embedded productsReverse engineering and source code review experienceVulnerability assessment and penetration testing experienceKnowledge of security-related topics, such as authentication, entitlements, identity management, data protection, data leakage prevention, validation checking, encryption, hashing, principle of least privilege, software attack methodologies, secure data transfer, secure data storage, etc.Knowledge of cryptography is desirableAbility to work independently under deadlineRigorous attention to detail and strong analytic skillsExcellent command of written and spoken EnglishComfortable working as part of a multi-national and multi-disciplinary teamLogical and structured approach to projectsFive years or more of relevant work experience in high-paced, enterprise environmentSecurity SkillsReverse engineering and source code review experienceVulnerability assessment and penetration testing experienceKnowledge of security-related topics, such as authentication, entitlements, identity management, data protection, data leakage prevention, validation checking, encryption, hashing, principle of least privilege, software attack methodologies, secure data transfer, secure data storage, etc.Knowledge of cryptography is desirableSoft SkillsAbility to work independently under deadlineRigorous attention to detail and strong analytic skillsExcellent command of written and spoken EnglishComfortable working as part of a multi-national and multi-disciplinary teamLogical and structured approach to projectsAdditional ExperienceFive years or more of relevant work experience in high-paced, enterprise environment