- 地点
- 代尔夫特，荷兰
- 工作方式
- 现场办公
- 类型
- 合同
- 部门
- 研发
- 编号
- 52848
职责
- 根据安全认证要求（如 SESIP、GlobalPlatform）进行设计审查。
- 根据安全认证要求执行代码审查和结构化漏洞分析。
- 审查同事的分析结果，并依据认证计划要求提供指导，为同事提供指导和辅导。
- 将漏洞分析结果转化为安全测试团队可执行的清晰信息，使结果与适用的方案阈值和评估指标保持一致。
- 对被评估设备进行嵌入式测试，例如固件逆向工程、中间人攻击、接口探测等。
- 与项目经理协调，领导评估项目的技术工作，确保合规性、技术严谨性和及时交付。
- 执行安全评估的技术部分，包括目标审查和必要的漏洞利用，主要围绕嵌入式系统和可信执行环境；fI 和 SCA 等专业硬件攻击由其他团队成员负责。
必备要求
- 至少 4 年安全评估领域经验。
- 精通以下至少两种编程语言：C、C++、汇编语言。
- 具备安全嵌入式系统方面的经验，例如智能卡、安全元件、片上系统 (SoC)、可信执行环境、智能灯、遥控器、ECU 等。
- 具备安全认证项目经验。
- 深入理解底层计算机体系结构、安全概念、嵌入式系统体系结构、操作系统内部原理、可信执行环境。
- 深入理解实用密码算法和协议。
- 优秀的沟通和人际交往能力，能在拥有不同利益相关者（技术团队、评估人员和客户）的团队环境中表现出色。
- 愿意偶尔前往欧洲、北美或亚洲拜访客户或认证机构。
优先条件
- 有 SESIP/PSA 经验者优先考虑。
Responsibilities
- Conduct design reviews against security certification requirements (e.g., SESIP, GlobalPlatform).
- Perform code reviews and structured vulnerability analysis against security certification requirements.
- Review colleagues' analysis results and provide guidance based on certification scheme requirements, mentoring and coaching colleagues.
- Translate vulnerability analysis results into clear, actionable information for the security testing team, aligning results with applicable scheme thresholds and evaluation metrics.
- Perform embedded testing on devices under evaluation, e.g., firmware reverse engineering, man-in-the-middle attacks, interface probing.
- Lead the technical aspects of evaluation projects in coordination with project managers to ensure compliance, technical rigor, and timely delivery.
- Execute the technical portion of security assessments, including target review and necessary exploitation, mostly around embedded systems and trusted execution environments; specialized hardware attacks such as fI and SCA are handled by other team members.
Must Have
- At least 4 years of experience in security assessment.
- Proficiency in at least two of the following programming languages: C, C++, assembly.
- Experience with secure embedded systems, e.g., smart cards, secure elements, systems on chip (SoC), trusted execution environments, smart lights, remote controls, ECUs.
- Experience with security certification programs.
- Deep understanding of low-level computer architecture, security concepts, embedded system architecture, operating system internals, and trusted execution environments.
- Deep understanding of practical cryptographic algorithms and protocols.
- Excellent communication and interpersonal skills, thriving in team environments with diverse stakeholders (technical teams, evaluators, customers).
- Willingness to travel occasionally to Europe, North America, or Asia to visit customers or certification bodies.
Preferred
- Experience with SESIP/PSA is a plus.
公司简介
Keysight 处于技术创新的最前沿，在电子设计、仿真、原型制作、测试、制造和优化等领域不断取得突破，并提供可靠的解决方案。我们拥有 10,000 名员工，为 100 多个国家的客户在通信、5G、汽车、能源、量子计算、航空航天、国防和半导体等领域提供世界一流的解决方案。我们屡获殊荣的企业文化秉持着大胆的愿景，相信技术能够带我们走向新的境界。我们热衷于用开创性的解决方案来应对各种挑战性问题。我们认为，当人们感受到归属感时，他们就会更加富有创造力、创新能力更强，并且在职业生涯的各个环节都能取得优异的成绩。