We are looking for an expert for our team that focuses on the security research of industrial control systems networks. The team deeply studies industrial equipment, software, and protocols, researches current attack methods against them, and develops mechanisms for their detection and prevention. The results of this work form the expert basis and enhance the functionality of the PT ISIM product.
Responsibilities:
- Research industrial protocols, equipment, software, and attack methods against them. Understand unknown or insufficiently documented technologies: analyze network traffic, event logs, configurations, and other technical data sources.
- Search for non-standard and practically implementable attack methods against the systems under research, assess possible ways to bypass security mechanisms, and verify formed hypotheses considering real operating conditions. Transform research results into working product expertise: protocol and event log parsers, attack detection rules, asset information gathering scripts, and data for vulnerability calculation.
- Independently design and implement research tools, parsers, scripts, and automation tools.
- Apply new technologies and approaches to solve research and product tasks, bring promising ideas to MVP or technical prototype, and present results to colleagues from product, engineering, and other departments.
- Conduct complex technical experiments, reproduce the behavior of industrial systems, and verify research hypotheses.
- Conduct technical reviews of research results and decisions made by other specialists.
- Develop one or more expert areas of the department, identify coverage gaps, and initiate new research.
- Participate in technical presales, pilots, training, and customer engagement as an expert.
- Present research results and team expertise to the external professional community: prepare articles, conduct webinars, and speak at industry conferences.
Requirements:
- Good understanding of network technologies, TCP/IP, and computer network principles.
- Confident knowledge of Windows and/or Linux at a level sufficient for technical research.
- Experience in one or more of the following areas: industrial cybersecurity; network traffic and protocol analysis; detection engineering; reverse engineering; operating systems or application software research; development of analysis and automation tools.
- Understanding of ICS architecture and the main classes of industrial equipment and software.
- Confident programming skills in Python, Go, C/C++, or another language suitable for research tasks.
- Ability to independently work with technical uncertainty: search for information, formulate hypotheses, conduct experiments, and verify results.
- Ability to read technical documentation and specifications, including in English.
- Ability to document research results and explain complex technical solutions to other specialists.
Will be an advantage:
- Practical experience with industrial protocols: Modbus, S7, OPC, EtherNet/IP, DNP3, PROFINET, or others.
- Experience developing network parsers or dissectors.
- Experience analyzing SCADA, HMI, DCS, PLC, engineering, or other industrial software. Experience researching network or host-based attack artifacts.
- Experience in reverse engineering of network protocols and proprietary data formats. Knowledge of MITRE ATT&CK for ICS and understanding of typical attack scenarios against technological infrastructure.
- Experience building laboratory testbeds and reproducing attacks or non-standard system behaviors.
- Experience in public speaking, conducting technical training, presales, or customer engagement.
Conditions:
- Hybrid work format, flexible start of the workday.
- Opportunities for continuous development: external and internal educational programs, meetups, popular science lectures, expert training, management training, and more.
- Flexible approach to rest: 28 calendar days of vacation, vacation pay topped up to full salary, and 10 days off per year.
- Health care: Voluntary medical insurance from the first week of employment, including dentistry, annual check-ups.
- Compensation of up to 50% of expenses for sports and English language studies within the annual budget.
- Work in an accredited IT company and the opportunity to use benefits from the Ministry of Digital Development.
