Pentester / Ethical Hacker – OT/ICS Cybersecurity

About DTSecLabs

DTSecLabs, located in the Berlin Metropolitan Area, and Belagavi, India, is a cybersecurity startup focused on Industry 4.0. We are developing a cybersecurity SaaS solution that helps industrial organizations identify vulnerabilities, understand attack surfaces and strengthen the security of their core infrastructure without disrupting normal operations.

The convergence of IT, IoT and OT environments has increased the complexity and vulnerability of OT networks. Our holistic, automated approach to vulnerability assessment addresses this challenge. As an early-stage team, we are collaborative and fast-moving, and we are growing our market presence through pilots with companies interested in evaluating our solutions.

About the role

We are looking for a Pentester / Ethical Hacker – OT/ICS Cybersecurity who is curious about how industrial systems work, how they communicate, and how cybersecurity weaknesses can affect their operations.

The candidate should have a strong foundation in networking, cybersecurity, and industrial communication protocols, with an interest in hands-on vulnerability research and penetration testing.

You will work on identifying security weaknesses in industrial systems, understanding attack techniques, developing proof-of-concept demonstrations, and validating vulnerabilities in controlled environments.

Key responsibilities

• Conduct authorized vulnerability assessments and penetration testing of web applications, APIs, networks, and industrial test environments.
• Research security vulnerabilities (CVEs), exploits, and attack techniques affecting industrial equipment, software, and communication protocols.
• Analyze industrial network traffic to understand communication patterns, identify security weaknesses, and investigate protocol misuse.
• Investigate potential security weaknesses in PLCs, RTUs, HMIs, SCADA systems, industrial gateways, and other OT devices.
• Examine network segmentation, firewall configurations, access control policies, and communication paths to identify potential attack surfaces.
• Study potential attack paths involving IT and OT networks, industrial controllers, engineering workstations, and critical assets.
• Develop Python scripts, security test cases, and proof-of-concept demonstrations to validate vulnerabilities.
• Perform security testing in isolated laboratory, simulated, or digital-twin environments without affecting live production systems.
• Apply MITRE ATT&CK for ICS to understand adversary techniques and evaluate relevant defensive measures.
• Document vulnerability findings, technical evidence, potential operational impact, reproduction steps, and recommended mitigations.
• Collaborate with software development, QA, and research teams to improve product security.

Required technical knowledge

1. Industrial communication protocols

The candidate should have a good conceptual understanding of industrial communication protocols, including their purpose, basic architecture, communication mechanisms, and associated security risks. Familiarity with the following protocols and standards is expected:

• IEC 61850: Communication standards used in power utility automation and substation systems.
• GOOSE: Event-oriented communication used in IEC 61850-based systems.
• MMS: Manufacturing Message Specification, used for communication and data exchange in industrial systems, including IEC 61850 environments.
• IEC 60870-5-101 and IEC 60870-5-104: Telecontrol protocols used in power system monitoring and control.
• Modbus RTU / TCP: Communication between industrial controllers, field devices, and monitoring systems.
• DNP3: Communication protocols commonly used in utility automation and supervisory control.
• PROFINET: Industrial Ethernet communication used in automation and control systems.
• EtherNet/IP: Industrial Ethernet protocol based on the Common Industrial Protocol (CIP).
• OPC UA: Industrial interoperability and information exchange.

The candidate should also understand:

• Common industrial protocol abuse patterns and their security implications.
• Authentication, authorization, and encryption capabilities or limitations of industrial protocols.
• Potential weaknesses arising from insecure configurations, exposed services, and unauthorized commands.
• Basic packet capture and protocol analysis using Wireshark or similar tools.
• Defensive network monitoring techniques for identifying abnormal industrial communication.
• The importance of distinguishing legitimate industrial operations from potentially malicious activity.

2. Networking and network security

A sound understanding of computer networking and network security concepts is essential. Expected knowledge includes:

• TCP/IP networking and the OSI model.
• IP addressing, subnetting, gateways, routing, and switching.
• TCP and UDP communication.
• Common communication ports, services, and networking protocols.
• Firewalls, firewall rules, and security policies.
• Access Control Lists (ACLs) and network access restrictions.
• VLANs and network segmentation.
• NAT, VPNs, remote access, and industrial network connectivity.
• Network traffic analysis and packet inspection.
• Network discovery and enumeration concepts.
• Basic concepts of IDS/IPS and defensive traffic monitoring.

The candidate should be able to explain how industrial devices communicate across network segments and how network configurations influence the exposure of industrial assets.

3. Industrial control systems and OT architecture

The candidate should have a basic understanding of industrial automation environments and the role of different devices in monitoring and controlling physical processes. Knowledge of the following systems is expected:

• PLC (Programmable Logic Controller): Industrial automation and machine control.
• RTU (Remote Terminal Unit): Remote monitoring, data acquisition, and control.
• DCS controllers: Distributed control of industrial processes.
• Protection relays: Monitoring and protection of electrical equipment and power systems.
• HVAC controllers: Monitoring and controlling heating, ventilation, and air-conditioning systems.
• HMI (Human-Machine Interface): Operator interaction with industrial equipment.
• SCADA: Supervisory monitoring, data acquisition, and control.
• Smart sensors and Industrial IoT devices: Data collection, measurement, and communication.

• Industrial gateways, switches, engineering workstations, and historians.

The candidate should understand how these systems interact, exchange information, and support industrial operations.

4. OT network architecture and security concepts

The candidate should have a basic understanding of:

• Purdue Model: Industrial network architecture and separation between enterprise and operational systems.
• Security zones: Grouping industrial assets based on common security requirements.
• Conduits: Managing and protecting communication between security zones.

• IT/OT network segmentation.
• Industrial DMZs and controlled remote access.
• Common attack entry points and potential lateral movement between industrial assets.

The candidate should be able to interpret a simple industrial network architecture diagram and identify potential security boundaries and communication pathways.

5. Ethical hacking and vulnerability research

• Understanding of vulnerability assessment and penetration-testing methodologies.
• Familiarity with tools such as Nmap, Wireshark, Burp Suite, Metasploit, and other security-testing utilities.
• Basic understanding of CVE, CVSS, CWE, and vulnerability advisories.
• Familiarity with OWASP Top 10 and common web application vulnerabilities.
• Understanding of MITRE ATT&CK, preferably including ATT&CK for ICS.
• Basic Linux command-line skills and operating system fundamentals.
• Ability to interpret security advisories and investigate affected product versions.
• Understanding of responsible disclosure and ethical, authorized security testing.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Electronics, Electrical Engineering, Information Technology, or a related field, or equivalent practical experience.
• 0–2 years of relevant experience in cybersecurity, networking, industrial automation, security research, or penetration testing.
• Strong analytical and problem-solving skills.
• Ability to independently investigate technical problems and document findings.
• Clear written communication and willingness to work collaboratively in a remote environment.

Nice to have

• Hands-on experience with PLCs, industrial networking, or industrial automation laboratory environments.
• Familiarity with CODESYS, OpenPLC, Factory I/O, or similar industrial simulation tools.
• Experience with Python-based security testing or protocol analysis.
• Exposure to vulnerability research involving embedded systems or industrial firmware.
• Familiarity with PKI, certificates, OPC UA security, or industrial device onboarding.
• Experience with Docker, virtual machines, and isolated security-testing environments.
• Participation in CTF competitions, cybersecurity research projects, or responsible vulnerability disclosure.
• Certifications such as eJPT, PNPT, CEH, or OSCP.
• Knowledge of ISA/IEC 62443, NIST SP 800-82, and related industrial security guidance.

What you can expect

• Work on practical cybersecurity challenges involving real industrial technologies and communication protocols.
• Develop hands-on experience in vulnerability research, protocol analysis, and controlled penetration testing.
• Participate in research involving industrial attack paths and digital-twin-based security validation.
• Collaborate with a multidisciplinary team working across cybersecurity, software engineering, and industrial automation.
• Take ownership of technical investigations, contribute ideas, and develop practical security research skills.