Enphase Energy is a global energy technology company and a leading provider of solar, battery, and electric vehicle charging products. Founded in 2006, our innovative microinverter technology revolutionized solar power, making it a safer, more reliable, and scalable energy source. Today, the Enphase Energy System enables users to make, use, save, and sell their own power. Enphase is also one of the most successful and innovative clean energy companies in the world, with more than 80 million products shipped across 160 countries.Join our dynamic teams designing and developing next-gen energy technologies and help drive a sustainable future!This role at Enphase requires working onsite 3 days a week, with plans to transition back to a full 5 day in office schedule over time. About the role:As a Senior Penetration Tester – IoT &amp; Embedded Devices, you will be part of a cutting-edge cybersecurity team focused on securing our connected energy ecosystem, including IQ Gateway, IQ Microinverters, IQ Batteries, and EV Chargers deployed across 4M+ homes in 150+ countries. These devices rely on bidirectional powerline communication, Wi-Fi and cellular networking, and cloud-managed over-the-air (OTA) firmware updates.You will lead offensive security testing across hardware, firmware, and software layers, while partnering closely with the CISO’s office to drive vulnerability lifecycle management from discovery to remediation. What you will be doing:<ul style="margin-top:0.0px;"><li>Perform hardware security testing: PCB teardown, component identification, bus sniffing and injection on UART/SPI/I²C, and logic-analyzer/oscilloscope signal capture</li><li>Reverse-engineer firmware — dump SPI/eMMC flash, unpack with Binwalk, perform static analysis in Ghidra/IDA, and emulate with QEMU to surface logic flaws and hardcoded secrets</li><li>Capture, analyze, and fuzz RF/wireless traffic with SDR tooling (HackRF/RTL-SDR) across BLE, Wi-Fi, sub-GHz, and cellular protocols</li><li>Test cloud APIs and backend services (REST, gRPC, MQTT) for authentication bypass, IDOR, injection, and broken access control</li><li>Lead end-to-end red-team exercises that chain device, network, and cloud footholds — lateral movement, privilege escalation, and persistence on embedded Linux/ARM platforms</li><li>Document findings with reproducible PoCs, CVSS scoring, and remediation guidance, and retest fixes through closure</li><li>Collaborate with internal security and engineering teams to strengthen product security</li><li>Ensure compliance with industry security standards and best practices</li></ul> <ul style="margin-top:0.0px;"><li>Perform JTAG/SWD debug-port attacks to extract, analyze, and modify device firmware</li><li>Assess the security of Wi-Fi, cellular, and bidirectional powerline (PLC) communication interfaces</li><li>Evaluate cloud-managed OTA firmware update mechanisms for integrity, authentication, and rollback protection</li></ul>What you bring:<ul style="margin-top:0.0px;"><li>BE/BTech/MS/MTech in Computer Science, Electrical Engineering, or a related field.</li><li>A minimum of 6+ years of experience in IoT/embedded penetration testing</li><li>Strong expertise in hardware and bus-level analysis (UART, SPI, I²C, JTAG/SWD), logic analyzers, and an understanding of fault-injection/glitching and side-channel techniques</li><li>Hands-on firmware reverse engineering and binary analysis across ARM and MIPS, including bootloader and RTOS internals</li><li>Proficiency with Ghidra/IDA Pro, Binwalk, QEMU, Burp Suite, and SDR/logic-analyzer hardware tools</li><li>Experience in RF/wireless fuzzing and API exploitation</li><li>Strong understanding of embedded Linux systems and ARM architectures</li><li>Knowledge of CVE disclosure processes and OWASP IoT Top 10</li><li>Familiarity with standards such as IEC 62443 and EU Cyber Resilience Act</li><li>Excellent analytical, problem-solving, and communication skills</li></ul> <ul style="margin-top:0.0px;"><li>Familiarity with Wi-Fi/cellular networking and bidirectional powerline (PLC) communication security</li><li>Experience with cloud-managed OTA update pipelines and full-stack red-team engagements spanning device, network, and cloud layers</li><li>Proficiency in Python and C/C++ for automation, tooling, and exploit development</li></ul>Nice to have:<ul style="margin-top:0.0px;"><li>Published CVEs, security advisories, or competitive Capture-the-Flag (CTF) experience</li><li>Exploit development and custom tooling for embedded and ARM targets</li><li>Relevant certifications such as OSCP, OSCE, GXPN, or GIAC GPEN</li></ul>What we offer:<ul style="margin-top:0.0px;"><li>Competitive compensation and comprehensive employee benefits</li><li>Opportunity to work on securing large-scale global IoT ecosystems</li><li>Exposure to cutting-edge technologies in embedded security</li><li>Collaborative and innovation-driven work environment</li><li>Career growth and development opportunities</li></ul>#ITSecurity

At Enphase, we think big. We’re on a mission to bring solar energy to the next level, one where it’s ready to meet the energy demands of an entire globe. As we work towards our vision for a solar-powered planet, we never lose sight of the three commitments that have guided us from the beginning: innovation, quality, and responsibility.
We’ve always pushed the boundaries of solar technology, ever since our founders took one look at a string inverter and knew they could do better. We’re still at it. We’re passionate about developing new technologies that make energy more intelligent, more connected, and more cost effective than ever before.

Mission
To deliver technology solutions that make clean energy affordable, reliable and accessible to all.

Values
We are experts in our discipline and love what we do
We are passionate about winning
We have high aspirations and set bold goals
We are enthusiastic about delivering the best customer experience
We are open, honest, transparent and respectful with our colleagues

Vision
The world's leading clean energy solution provider

We're changing energy. Come join us.

Senior Penetration Tester – IoT & Embedded Devices

Enphase Energy is a global energy technology company and a leading provider of solar, battery, and electric vehicle charging products. Founded in 2006, our innovative microinverter technology revolutionized solar power, making it a safer, more reliable, and scalable energy source. Today, the Enphase Energy System enables users to make, use, save, and sell their own power. Enphase is also one of the most successful and innovative clean energy companies in the world, with more than 80 million products shipped across 160 countries.Join our dynamic teams designing and developing next-gen energy technologies and help drive a sustainable future!This role at Enphase requires working onsite 3 days a week, with plans to transition back to a full 5 day in office schedule over time. About the role:As a Senior Penetration Tester – IoT &amp; Embedded Devices, you will be part of a cutting-edge cybersecurity team focused on securing our connected energy ecosystem, including IQ Gateway, IQ Microinverters, IQ Batteries, and EV Chargers deployed across 4M+ homes in 150+ countries. These devices rely on bidirectional powerline communication, Wi-Fi and cellular networking, and cloud-managed over-the-air (OTA) firmware updates.You will lead offensive security testing across hardware, firmware, and software layers, while partnering closely with the CISO’s office to drive vulnerability lifecycle management from discovery to remediation. What you will be doing:<ul><li>Perform hardware security testing: PCB teardown, component identification, bus sniffing and injection on UART/SPI/I²C, and logic-analyzer/oscilloscope signal capture</li><li>Reverse-engineer firmware — dump SPI/eMMC flash, unpack with Binwalk, perform static analysis in Ghidra/IDA, and emulate with QEMU to surface logic flaws and hardcoded secrets</li><li>Capture, analyze, and fuzz RF/wireless traffic with SDR tooling (HackRF/RTL-SDR) across BLE, Wi-Fi, sub-GHz, and cellular protocols</li><li>Test cloud APIs and backend services (REST, gRPC, MQTT) for authentication bypass, IDOR, injection, and broken access control</li><li>Lead end-to-end red-team exercises that chain device, network, and cloud footholds — lateral movement, privilege escalation, and persistence on embedded Linux/ARM platforms</li><li>Document findings with reproducible PoCs, CVSS scoring, and remediation guidance, and retest fixes through closure</li><li>Collaborate with internal security and engineering teams to strengthen product security</li><li>Ensure compliance with industry security standards and best practices</li></ul> <ul><li>Perform JTAG/SWD debug-port attacks to extract, analyze, and modify device firmware</li><li>Assess the security of Wi-Fi, cellular, and bidirectional powerline (PLC) communication interfaces</li><li>Evaluate cloud-managed OTA firmware update mechanisms for integrity, authentication, and rollback protection</li></ul>What you bring:<ul><li>BE/BTech/MS/MTech in Computer Science, Electrical Engineering, or a related field.</li><li>A minimum of 6+ years of experience in IoT/embedded penetration testing</li><li>Strong expertise in hardware and bus-level analysis (UART, SPI, I²C, JTAG/SWD), logic analyzers, and an understanding of fault-injection/glitching and side-channel techniques</li><li>Hands-on firmware reverse engineering and binary analysis across ARM and MIPS, including bootloader and RTOS internals</li><li>Proficiency with Ghidra/IDA Pro, Binwalk, QEMU, Burp Suite, and SDR/logic-analyzer hardware tools</li><li>Experience in RF/wireless fuzzing and API exploitation</li><li>Strong understanding of embedded Linux systems and ARM architectures</li><li>Knowledge of CVE disclosure processes and OWASP IoT Top 10</li><li>Familiarity with standards such as IEC 62443 and EU Cyber Resilience Act</li><li>Excellent analytical, problem-solving, and communication skills</li></ul> <ul><li>Familiarity with Wi-Fi/cellular networking and bidirectional powerline (PLC) communication security</li><li>Experience with cloud-managed OTA update pipelines and full-stack red-team engagements spanning device, network, and cloud layers</li><li>Proficiency in Python and C/C++ for automation, tooling, and exploit development</li></ul>Nice to have:<ul><li>Published CVEs, security advisories, or competitive Capture-the-Flag (CTF) experience</li><li>Exploit development and custom tooling for embedded and ARM targets</li><li>Relevant certifications such as OSCP, OSCE, GXPN, or GIAC GPEN</li></ul>What we offer:<ul><li>Competitive compensation and comprehensive employee benefits</li><li>Opportunity to work on securing large-scale global IoT ecosystems</li><li>Exposure to cutting-edge technologies in embedded security</li><li>Collaborative and innovation-driven work environment</li><li>Career growth and development opportunities</li></ul>#ITSecurity

Senior Penetration Tester – IoT & Embedded Devices

About the Job

About the Company

EnPhase Energy

Similar Jobs

(Senior) Embedded Linux Engineer (m/f/d)

(Senior) Embedded Linux Engineer (m/f/d)

Purple Teaming Engineer - Embedded Security

Purple Teaming Engineer - Embedded Security

Device - Software Engineer (Firmware)

Device - Software Engineer (Firmware)

IT/OT Security Engineer

IT/OT Security Engineer

ICS Cybersecurity Engineer

ICS Cybersecurity Engineer

ICS Cybersecurity Engineer

ICS Cybersecurity Engineer

Sr. Embedded Security Engineer

Sr. Embedded Security Engineer

Senior Manager – Secure Software Development Lifecycle (SSDLC)

Senior Manager – Secure Software Development Lifecycle (SSDLC)

Senior Cyber Security Engineer

Senior Cyber Security Engineer

Embedded Security Architect

Embedded Security Architect