> Markdown version of [/jobs/ext/4706407-principal-penetration-tester-embedded-devices](https://www.wearedevelopers.com/jobs/ext/4706407-principal-penetration-tester-embedded-devices). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal Penetration Tester, Embedded Devices - **Company:** TP-Link Systems Inc. - **Location:** Irvine, CA, United States - **Experience:** Expert - **Salary:** $220,000 - $230,000 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Software System Penetration Testing, Automation of Tests, Bash Shell, Burp Suite, C++ (Programming Language), CompTIA Security+, Cyber Security, Computer Programming, Computer Engineering, Software Debugging, Firmware, Hardware Security Module, Mobile Application Software, Joint Test Action (IEEE Standards), Python (Programming Language), Kali Linux, Network Service, Nmap, Windows PowerShell, Cloud Services, Reverse Engineering, Security Software, EndPointSecurity, Wi-Fi Technology, Scripting, Software Security, Information Technology, Metasploit, IDA Pro, Nessus, Wireless Technologies, U-Boot, Vulnerability Analysis - **Published:** November 13, 2026 - **Apply:** https://www.careerbuilder.com/job-details/principal-penetration-tester-embedded-devices-irvine-ca--e9e61ce4-0662-4ac3-87f8-0091813faeaa ## About the Role Penetration Testing, Embedded Systems, Wi-Fi, Smart Homes, Customer Support/Service, Threat Modeling, Leadership, Internet of Things, Ecosystems, Technical Strategy, * Bachelor's degree in computer science, Computer Engineering, Electrical Engineering, Information Security, or a related field, or equivalent practical experience. * 8 or more years of progressive experience in embedded-device security, penetration testing, vulnerability research, exploit development, or a closely related discipline, including demonstrated technical leadership across complex programs * Expert-level knowledge of embedded architectures, firmware, operating systems, secure boot, hardware security mechanisms, protocol security, cryptography, wireless technologies, and common vulnerability classes. * Extensive hands-on experience with tools such as Burp Suite, Nmap, Kali Linux, Nessus, Metasploit, IDA Pro, Ghidra, JTAG/SWD interfaces, logic analyzers, debuggers, and hardware or firmware extraction techniques, including the ability to extend or customize tooling. * Demonstrated ability to design advanced penetration-testing methodologies, fuzzing strategies, automated security-testing platforms, and repeatable assessment frameworks for diverse product families. * Expertise in reverse engineering, binary analysis, exploit development, and vulnerability discovery across hardware, firmware, applications, network services, cloud components, and mobile ecosystems.ยท Advanced programming and scripting skills in languages such as C/C++, Python, Bash, and PowerShell, with the ability to produce high-quality security tools, automation, and proof-of-concept exploit code. * Proven ability to influence architecture and engineering decisions without direct authority, lead technical reviews, mentor experienced engineers, and communicate risk to both technical and executive audiences. * Relevant advanced certifications such as OSCP, OSEP, OSWE, GXPN, GREM, CISSP, or comparable demonstrated expertise are preferred. Publicly credited CVEs, security research, conference presentations, patents, or significant open-source contributions are highly valued. Soft Skills: * Recognized technical leadership and a strong record of mentoring senior and developing engineers. * Exceptional written and verbal communication, including the ability to present complex risk and remediation recommendations to executive and engineering audiences. * Strategic thinking, sound judgment, and the ability to prioritize systemic risk across multiple products and concurrent initiatives. * High ownership, intellectual curiosity, and the ability to operate independently while building alignment across product, R&D, QA, legal, compliance, and business teams. ## Description TP-Link Systems Inc. is seeking a highly accomplished Principal Penetration Tester, Embedded Devices to define and lead the technical strategy for offensive security across our embedded product portfolio. This individual-contributor leadership role will establish advanced testing methodologies, direct complex assessments of IoT ecosystems, and influence product architecture and security priorities across multiple business and engineering teams. The Principal Penetration Tester will serve as a trusted technical authority for vulnerability research, exploit development, threat modeling, coordinated vulnerability response, and security validation throughout the product lifecycle. The ideal candidate combines exceptional hands-on expertise in embedded systems security with the strategic judgment to identify systemic risk, establish reusable testing capabilities, mentor senior engineers, and communicate material findings to engineering and executive stakeholders. This role is expected to raise the maturity of TP-Link's offensive security program and help ensure that products meet evolving global cybersecurity standards and regulatory expectations., * Offensive Security Strategy: Define and execute the enterprise technical strategy, roadmap, and standards for penetration testing of embedded devices, mobile applications, cloud services, APIs, wireless interfaces, and complete IoT ecosystems. * Advanced Assessments: Lead the most complex, high-risk penetration tests and architecture-level security assessments across multiple product lines, including hardware, firmware, boot chains, operating systems, cryptographic implementations, protocols, and supporting services. * Vulnerability Research and Exploit Development: Conduct original research, develop proof-of-concept exploits, analyze root causes, and identify systemic vulnerability patterns that may affect multiple products or platforms. * Threat Modeling and Design Influence: Establish scalable threat-modeling practices and advise product architects and engineering leaders on secure design decisions, compensating controls, and risk acceptance. * Security Tooling and Automation: Architect and develop custom security tools, fuzzing harnesses, firmware-analysis pipelines, exploit frameworks, and automated testing platforms that expand coverage and improve repeatability. * Product Security Integration: Drive the integration of offensive security requirements and validation gates throughout the secure product development lifecycle, including design reviews, pre-release testing, and post-release assurance. * Incident and Vulnerability Response: Provide senior technical leadership for critical product-security incidents and coordinated vulnerability disclosure, including severity assessment, exploitation analysis, remediation validation, and lessons learned. * Certification and Regulatory Readiness: Serve as a technical authority for product cybersecurity certifications, standards, and regulatory assessments, including NIST, ETSI EN 303 645, SOG-IS, and other applicable global requirements. * Technical Leadership and Mentorship: Mentor penetration testers and product-security engineers, establish review standards, lead technical communities of practice, and elevate offensive-security capabilities across R&D and QA organizations. * Executive and Cross-Functional Communication: Translate complex technical findings into clear business risk, remediation priorities, and strategic recommendations for product, engineering, legal, compliance, and executive stakeholders.