--- title: 'Senior Engineer - Penetration Testing at Finite State' canonical: 'https://feeny.ai/job/senior-engineer-penetration-testing-finite-state-united-states-or-ye4m4jcdygvr' type: 'job' last_seen: '2026-10-20' --- # Senior Engineer - Penetration Testing at Finite State - **Company:** Finite State - **Location:** United States OR, Canada - **Work type:** remote - **Posted:** 2026-10-09 - **Last confirmed live:** 2026-10-20 - **Apply:** https://job-boards.greenhouse.io/finitestate/jobs/6221586004 ## Job description Finite State partners with product security teams, the guardians of our connected world, to create transparency for their connected devices and supply chains. Our platform handles connected devices and embedded systems across all industries, including those found in enterprises, healthcare, utilities, connected vehicles, manufacturing facilities, critical infrastructure, and government entities. We are a fast-growing series-B company with a fully distributed workforce. Led by a team of seasoned experts, we are a mission-driven team passionate about arming our customers with the actionable insights, critical vulnerability data, and remediation guidance necessary to mitigate product risk and protect the connected attack surface. We are committed to a remote first culture. Senior Engineer - Penetration Testing - Department: Services - Location: Remote, United States - no relocation required. Must be authorized to work in the U.S. without sponsorship. - Travel: Limited - occasional trips for customer-site assessments, conferences, and team gatherings. - Equipment: Finite State ships and funds your bench lab - soldering and rework station, probes, programmers, logic analyzer, and radios - to wherever you work. You do not fund your own gear, and the role is not tied to a company site. ## About the Role Connected products run the world: vehicles, medical devices, industrial systems, and critical infrastructure—and securing them is one of the hardest engineering problems there is. Finite State is seeking an experienced Senior Engineer — Penetration Testing to join our growing Offensive Security team. In this role you will conduct hands-on hardware and software penetration tests of connected devices, embedded systems, industrial control systems, and automotive platforms on behalf of our customers. You will combine deep hardware and firmware expertise with a consultative mindset to deliver clear, actionable findings that help manufacturers and operators understand and reduce risk. What makes this role different from a generalist penetration testing seat: you have Finite State's firmware analysis platform behind you, so your time goes to proving what is actually exploitable on real hardware rather than to building a baseline by hand. Your core mandate is hands-on penetration testing. Over time, as you build depth with our platform and customer base, there will be opportunities to expand your  scope - platform integrations, direct account ownership, and building tools that drive the business. ## What You'll Do Core delivery - the majority of your time - Plan and execute penetration tests against IoT, ICS/OT, and automotive targets, including connected consumer devices, industrial controllers, and automotive ECUs and telematics units. - Own engagements largely autonomously - scoping, prioritizing attack surfaces, testing, evidence, reporting, and debrief. - Use Finite State's platform analysis alongside your own testing to focus effort on the vulnerabilities that are genuinely reachable and exploitable on the target. - Perform hardware interaction and firmware extraction using techniques such as JTAG, SWD, UART, SPI, I2C, eMMC, NOR/SPI flash, and NAND flash dumping; solder and rework PCBs as needed to gain access to debug interfaces. - Conduct firmware reverse engineering using tools such as Ghidra and Binary Ninja to identify vulnerabilities including memory corruption, authentication bypasses, hard-coded credentials, and insecure update mechanisms. - Assess wireless protocols common in IoT and automotive environments: Bluetooth/BLE, Zigbee, Z-Wave, Wi-Fi, and cellular (LTE/5G). - Assess vehicle buses - CAN, LIN, and automotive Ethernet - and the industrial control protocols riding on ICS/OT networks, including Modbus, DNP3, EtherNet/IP, and OPC-UA. - Assess standard network protocols and companion attack surfaces - TCP/IP fundamentals, exposed services, cloud and mobile companion apps and APIs - using standard web application testing methodology (e.g., OWASP Top 10) where relevant. - Perform source code review, primarily in C, C++, and related embedded languages, to identify security weaknesses in firmware and embedded software. - Review third-party and open-source components in scope for the engagement - SBOM review and software composition analysis - to identify known vulnerabilities and license risk in the customer's supply chain. - Leverage AI-powered security tooling and LLM-assisted workflows to accelerate analysis, triage, and reporting, using approved tooling and honoring customer data-handling and NDA constraints on firmware and findings. Maintain awareness of evolving AI capabilities relevant to embedded security research. - Evaluate customer products for compliance with relevant regulations and standards where in scope for the engagement. - Produce high-quality written reports that clearly communicate technical findings, risk ratings, and remediation guidance to both technical and executive audiences. Score findings on CVSS and prioritize by demonstrated exploitability - a proven-exploitable medium outranks an unreachable critical - and support not-affected determinations with a defensible VEX justification. - Participate in peer review of engagement deliverables, both as author and reviewer, before reports reach the customer. - Support customer-facing engagements including scoping calls, technical debriefs, and remediation follow-up. Beyond delivery - Collaborate with the product, engineering, and research teams to feed engagement findings back into the Finite State platform and improve its detection capabilities. - Contribute to internal knowledge sharing, tooling development, and methodology improvement. - Participate in industry conferences, publish research, and represent Finite State externally as opportunities arise. ## Qualifications - Bachelor's degree in Computer Science, Electrical Engineering, Computer Engineering, or a related field (or equivalent hands-on experience), plus 7+ years of hands-on experience in IoT, embedded, ICS/OT, or automotive security, with a track record of owning engagements autonomously at a senior level. - Hands-on depth in at least one of our three target domains - IoT/embedded, ICS/OT, or automotive - plus working familiarity with the other two. We staff engagements across all three; we do not expect equal mastery of all three. - Demonstrated experience performing hardware-level security assessments: JTAG/SWD debugging, SPI/I2C/UART communication, and flash memory extraction. Comfort soldering and reworking PCBs to reach a debug interface is expected; fine-pitch and BGA rework is a plus, not a gate. - Proficiency with firmware reverse engineering tools, specifically Ghidra and/or Binary Ninja; ability to analyze ARM, MIPS, PPC, RISC-V, x86, and x64 architectures. - Experience testing wireless protocols (BLE, Zigbee, Z-Wave, Wi-Fi, cellular) and either vehicle buses (CAN, LIN, automotive Ethernet) or industrial control protocols (Modbus, DNP3, EtherNet/IP, OPC-UA) — consistent with depth in one target domain and familiarity with the others. - Working familiarity with standard network protocols and web/mobile application testing methodology - many IoT and automotive targets ship with companion apps and cloud APIs that are part of the real attack surface. - Ability to read and review source code in C and C++ to identify memory safety issues, authentication flaws, and other security weaknesses in embedded software. - Familiarity with SBOM concepts, formats (CycloneDX, SPDX), and the use of SBOMs in vulnerability management. - Working fluency with CVSS scoring and VEX, including how an exploitability determination is defended to a customer. - Ability to map findings to at least one relevant regulatory or standards framework and explain the implications to a customer. Breadth across frameworks is a plus, not a requirement. - Excellent written and verbal communication skills; proven ability to write clear, well-structured technical reports and present findings to diverse audiences. - Experience with scripting and automation using Python and Bash to support tooling and workflow efficiency. - Familiarity with AI-assisted security tooling and an interest in applying LLM-based workflows to accelerate security analysis and reporting. --- ## Preferred Qualifications - Hands-on automotive security experience: OBD-II assessment, ECU flashing and analysis, V2X protocols, or automotive HSM evaluation. - Experience with industrial control system (ICS/SCADA) security assessments and familiarity with protocols such as Modbus, DNP3, EtherNet/IP, or OPC-UA. - CVE or responsible disclosure history, or other demonstrated exploit development / vulnerability research - valuable but understood to often be scarce or NDA-restricted; not a gating requirement. - Relevant certifications a plus, not required: Offensive Security (OSCP, OSWE) or SANS/GIAC (GPEN, GICSP), or vendor-specific automotive security credentials. - Working knowledge of specific regulations and standards - a subset is plenty, not comprehensive mastery: EU Cyber Resilience Act (CRA), CE RED / EN 303 645, UNECE WP.29 / ISO 21434 (automotive), IEC 62443, FDA premarket cybersecurity requirements, or the US IoT Cyber Trust Mark. - Eligibility for U.S. government security clearance - a plus for accounts with federal/defense exposure, but not a requirement and should not disqualify strong candidates otherwise. - Familiarity with static and dynamic analysis platforms and SAST/DAST tooling in the context of firmware and embedded software. - Experience with ML-based vulnerability detection models or AI-augmented reverse engineering pipelines. - Experience working on small, fast-moving consulting or product security teams. - Comfort operating in AWS or similar cloud environments used to support analysis pipelines or customer deliverables. - Strong attention to detail, intellectual curiosity, and the ability to adjust priorities quickly in a dynamic environment. - Interest in expanding into broader customer-facing and engineering responsibilities. --- Working Conditions This is a hands-on hardware role. You will work in a bench lab environment with soldering and rework equipment, and occasionally on customer sites where live industrial or medical equipment is present - engagements in those environments follow customer safety procedures and agreed rules of engagement, and testing against production OT is never performed without written authorization. Some customer hardware and technical data is subject to U.S. export control (ITAR/EAR), and a subset of engagements is restricted to U.S. persons as those rules define the term. Baseline eligibility for this role is U.S. work authorization without sponsorship; the export-restricted subset is a portion of the work, not the whole role, and we will be explicit about which accounts it affects. ## About Finite State At Finite State, we're on a mission to secure the connected world. Our platform empowers product security teams to detect vulnerabilities, manage software supply chain risks, and ensure compliance across complex device ecosystems. From IoT to critical infrastructure, we provide unparalleled visibility into firmware and software components, helping organizations protect their products and customers. We move with urgency and intent — we’re transparent, own outcomes, put customers first, speak up, and learn fast — turning evidence into action. CLARITY is how we move fast without breaking trust. - C - Customer first - Learn from customers. Ship with urgency. - L - Leverage - Outsource the routine. Own the result. - A - Agency - We take responsibility—end to end. - R - Results - Ship value. Improve fast. - I - Integrity - Speak up. Experiment boldly. Be kind. - T - Transparency - Clear context. Faster decisions. - Y - "Why" - Our mission—securing the connected products humanity depends on—is the reason Finite State exists. CLARITY is how we make that mission real, every day, at speed Bold Innovation – We push boundaries, explore new ideas, and take initiative to solve complex problems. The Finite State platform brings visibility and control to the supply chains that create connected devices and embedded systems—all in a simple to use platform and at the scale manufacturers need to keep device production on time and on budget. After unpacking and analyzing every file, configuration, and setting in a firmware build, the platform generates a complete bill of materials for software components, identifies known and 0-day vulnerabilities, shows a contextual risk score, and provides actionable insights that product teams can use to secure their software We are proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. Finite State is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. ## About Finite State ## Company Overview - **One-liner**: Finite State provides an AI-native platform that automates product security across the full lifecycle for connected devices, enabling manufacturers to design, verify, and prove compliance with regulations like the EU Cyber Resilience Act. - **Entity Type**: Private (Series B) - **Headquarters**: Columbus, Ohio, United States - **Founded**: 2017 - **Founders**: Not publicly disclosed ## Core Business - **Primary industry**: Computer and Network Security / Product Cybersecurity (focusing on IoT, medical devices, automotive, and OT/ICS) - **Target customers**: B2B — Device OEMs and manufacturers in automotive, medical device, and industrial sectors; also serves enterprise and government clients - **Mission or purpose statement**: To empower device OEMs to ship securely while enabling engineering teams to move at the speed of AI, transforming product artifacts into audit-ready assurance through a single automated workflow. ## Products & Services - **[Finite State Platform]**: A SaaS platform that leverages deep binary analysis and AI-native execution to unify code, compiled components, and firmware in minutes. It automates threat modeling, generates SBOMs (Software Bills of Materials), VEX documents, and signed compliance packages. The platform connects security design with deployed software and is designed to help manufacturers meet regulations like the EU Cyber Resilience Act (CRA). - **[Managed Services]**: A managed service offering to help medical device manufacturers and others achieve EU CRA compliance, providing industry-leading security services to navigate evolving regulations and enhance product security posture. - **[Binary Analysis Engine]**: A core technology for reachability-based triage of vulnerabilities in binaries and firmware, enabling deep visibility into shipped code. ## Market Standing - **Valuation/Market Cap**: Not disclosed (Private company) - **Key Metric**: **Annual Revenue** of ~$8.7M (USD) | **Total Funding** of $69.5M across 4 rounds - **Notable Investors/Partners**: - Energy Impact Partners (Lead investor in Series A and Series B) - Drive Capital (Lead investor in Seed Round) - Zetta Venture Partners (Seed Round) - National Grid Partners (NGP) - Energize Capital (Lead investor in Series B) - **Growth Signals**: - Headcount grew **+24.2% YoY** (15 people added), now employing 61 people. - Acquired **MergeBase** in June 2024 to expand capabilities. - Expanding globally with offices in Canada, UK, Argentina, Singapore, and Israel. - Recent job postings (Senior Software Engineer AI/ML, Regional Sales Director) indicate continued investment. ## Competitive Advantages - **AI-Native, Full Lifecycle Automation**: Differentiates by automating the entire security lifecycle (design → verify → prove) rather than just scanning or vulnerability management. - **Deep Binary Analysis**: Proprietary reachability-based triage that goes beyond typical SCA (Software Composition Analysis) to understand which vulnerabilities are actually exploitable in a shipped device. - **Regulatory Compliance Focus**: Specifically built to help manufacturers navigate complex, emerging regulations like the EU Cyber Resilience Act (CRA) and FDA requirements for medical devices, a key pain point for OEMs. - **Continuous Compliance Output**: Automatically generates audit-ready artifacts (SBOMs, VEX, compliance packages) tied to every release, reducing friction between security and engineering teams. ## Strategic Focus - **Expanding into Automotive & Medical Devices**: The platform and managed services are heavily tailored for these regulated, high-stakes industries. - **Scaling AI & Automation**: Continued investment in AI/ML capabilities (as seen in current hiring for Senior Software Engineer AI/ML). - **Post-Acquisition Integration**: Absorbing MergeBase’s technology and talent to broaden its software supply chain security offerings. - **Global Market Penetration**: Growing presence in key markets (Canada, UK, Singapore, Israel) to support multinational OEMs. ## Why Work Here - **Culture**: Described as a "leading provider" in product cybersecurity with a focus on mission-driven work — securing critical infrastructure and medical devices. LinkedIn reviews rate compensation highly (4.3/5) but suggest work-life balance is a challenge (2.8/5). - **Engineering & Tech Stack**: A modern stack including **Python, Django, Kubernetes, PostgreSQL, Redis, GraphQL, React, Docker, and Node.js**. The team works on advanced AI/ML for binary analysis and threat modeling. - **Remote/Hybrid Policy**: Not explicitly stated, but offices are located in Columbus, OH (HQ), with a distributed team across the US, Canada, UK, Argentina, Singapore, and Israel, suggesting a flexible or hybrid model is likely. - **Notable Perks**: Working on a cutting-edge platform at the intersection of cybersecurity and AI; involvement in high-impact regulatory compliance work; opportunity to shape product security for connected devices globally. ## Sources 1. [finitestate.io](https://finitestate.io/) 2. [finitestate.io/careers](https://finitestate.io/careers) 3. [finitestate.io/about](https://finitestate.io/about) 4. [linkedin.com/company/finitestate](https://www.linkedin.com/company/finitestate) 5. [finitestate.io/platform](https://finitestate.io/platform) ## Other roles at Finite State - [Senior Engineer - Penetration Testing](https://feeny.ai/job/senior-engineer-penetration-testing-finite-state-united-states-or-ej7w6r74jr2p) — United States OR, Canada - [Senior Engineer - Penetration Testing](https://feeny.ai/job/senior-engineer-penetration-testing-finite-state-united-states-or-18sx7cf1a6t4) — United States OR, Canada - [Head of Product](https://feeny.ai/job/head-of-product-finite-state-united-states-rjcnyxvrnwka) — United States - [BDR](https://feeny.ai/job/bdr-finite-state-united-states-dw0sv6aeyrfm) — United States - [Senior QA Engineer - AI/ML](https://feeny.ai/job/senior-qa-engineer-ai-ml-finite-state-singapore-60e18151jphz) — Singapore - [Regional Sales Director (Northeast)](https://feeny.ai/job/regional-sales-director-northeast-finite-state-united-states-cpkp0rr29ggp) — United States - [Regional Sales Director (West)](https://feeny.ai/job/regional-sales-director-west-finite-state-united-states-3xh8585q3pzv) — United States - [Staff Product Manager](https://feeny.ai/job/staff-product-manager-finite-state-united-states-or-ybrbnggh8v38) — United States OR, Canada