Securin is an AI-native cybersecurity company. Our Preemptive Exposure Management Platform turns exposure data into clear decisions — giving organizations the confidence to know which risks are exploitable, what to fix first, and how to act before attackers do.

Duties and Responsibilities

OT / ICS Penetration Testing:

- Plan and execute safety-first penetration tests of OT/ICS environments (water and wastewater, energy, manufacturing, building systems), including passive asset discovery, Purdue-model segmentation testing and IT-to-OT pivot analysis.
- Assess PLCs, RTUs, HMIs, SCADA servers, historians and engineering workstations across major vendors (e.g., Rockwell/Allen-Bradley, Siemens, Schneider Electric) and SCADA platforms (e.g., VTScada, Ignition, AVEVA/Wonderware).
- Test industrial protocols such as Modbus/TCP, DNP3, EtherNet/IP/CIP, S7comm, OPC UA, BACnet and IEC 60870-5-104/61850 for authentication, integrity and logic-manipulation weaknesses.
- Build and use lab or digital-twin replicas to validate attack paths before touching production; operate strictly within client-approved rules of engagement, change windows and safety constraints.
- Map findings to ISA/IEC 62443, NIST SP 800-82 and MITRE ATT&CK; for ICS, with remediation guidance that is realistic for plant operations.

Exploit Development & Zero-Day Discovery:
- Conduct vulnerability research on binaries, firmware, embedded/IoT devices, web applications and enterprise software using reverse engineering, source code review and fuzzing (coverage-guided, protocol-aware and grammar-based).
- Write reliable proof-of-concept and weaponized exploits for memory corruption (stack/heap overflows, use-after-free, type confusion), logic flaws and authentication bypasses, including bypass of up-to-date mitigations (ASLR, DEP/NX, CFG, stack canaries).
- Perform n-day analysis and patch diffing to rapidly validate exploitability of newly disclosed CVEs for clients and for Securin’s exposure intelligence.
- Apply AI-augmented techniques, such as LLM-assisted code review, agent-driven fuzz harness generation and automated crash triage, to scale discovery within Securin’s Zero Day program.
- Run coordinated vulnerability disclosure with vendors, CERTs and CNAs, and author technical advisories and research publications.

AI & Agentic System Pentesting:
- Assess LLM applications, RAG pipelines, autonomous agents and tool integrations (including MCP servers and plugins) for direct and indirect prompt injection, jailbreaks, sensitive data disclosure, excessive agency, insecure output handling, tool abuse and supply-chain weaknesses.
- Test against the OWASP Top 10 for LLM Applications, OWASP agentic AI threat guidance, MITRE ATLAS and the NIST AI RMF, and translate results into concrete architectural fixes.
- Build and operate automated adversarial testing harnesses (e.g., PyRIT, garak, promptfoo)



and custom attack agents for repeatable AI red teaming.
- Contribute offensive techniques and agent workflows to Securin’s AI-driven offensive security platform and autonomous pentesting research.

Core Delivery & Team Contribution:
- Conduct network, web application, API, cloud and red team engagements, emulating real-world adversaries using the MITRE ATT&CK; framework.
- Develop and execute detailed test plans and methodologies; manage engagement timelines, deadlines and client expectations.
- Prepare high-quality reports using Securin templates and present findings to technical and executive stakeholders in kick-off calls and readouts.
- Advise developers, system administrators and OT engineers on secure configuration, coding best practices and remediation.
- Mentor analysts, contribute to internal training, methodology and tooling, and help shape report deliverables.

Requirements:

- Minimum 2-5 years of hands-on penetration testing and offensive security experience, including significant depth in at least two of: OT/ICS security, exploit development/vulnerability research, and AI/LLM security.
- Demonstrated OT/ICS penetration testing experience on real industrial environments or high-fidelity labs, with a strong grasp of safety-first testing practices.
- Proven exploit-writing ability, evidenced by original vulnerability research: CVE credits, published advisories or exploits, conference talks, or high-level bug bounty/CTF results.
- Hands-on experience testing LLM applications or agentic AI systems, with a working understanding of how models, retrieval, tools and permissions combine to create attack surface.
- Strong programming skills in Python and C/C++, and working knowledge of x86/x64 and ARM assembly; Bash/PowerShell required; Rust or Go a plus.
- Proficiency with reverse engineering and debugging tools (IDA Pro, Ghidra, Binary Ninja, WinDbg, GDB with pwndbg/GEF), fuzzers (AFL++, libFuzzer, boofuzz) and offensive tooling (Burp Suite, Metasploit, Nmap, Wireshark with ICS dissectors, C2 frameworks such as Cobalt Strike or Sliver).
- Familiarity with industry standards and frameworks including OWASP Top 10, CVE/CWE, OSSTMM, NIST, MITRE ATT&CK;, ISA/IEC 62443 and MITRE ATLAS.
- Bachelor’s degree in Computer Science, Information Security, Electrical/Control Engineering or a related field, or equivalent practical experience.
- Excellent written and spoken English; able to convey complex technical concepts to technical and non-technical audiences.

Core AI Specific Skill Requirements in General:





Securin is committed to becoming an AI-native organization where GenAI is embedded into how every team works - not just as an occasional assistant, but as a core part of delivery, operations, and how our expertise compounds over time. We expect every employee to integrate GenAI tools into daily workflows actively - automating routine tasks, accelerating research and analysis, drafting documents, and building reusable AI-powered processes for their function. You should understand the limitations of GenAI (including inaccuracies and data sensitivity boundaries), follow data classification rules, and continuously improve your AI proficiency.

As you grow, we expect you to move beyond using GenAI to building with it - designing agent workflows, contributing reusable skills, and helping Securin compound its Proactive Exposure Management expertise faster than any competitor can replicate.

- Demonstrated ability to use GenAI tools (e.g., Claude, ChatGPT, etc.) for daily work - drafting, research, summarization, data analysis, code generation, or workflow automation as relevant to the role
- Working knowledge of GenAI limitations including hallucination risk, context window constraints, and data sensitivity boundaries; ability to validate AI-generated output before acting on it
- Familiarity with prompt engineering techniques - structuring multi-step instructions, providing context, and iterating on output quality to achieve production-grade results
- Comfort with Agentic AI workflows - using, designing, or building multi-step AI agents that execute tasks autonomously with human-in-the-loop validation
- Awareness of AI security fundamentals - prompt injection risks, data classification rules, sandboxed execution, and responsible handling of sensitive data in AI workflows
- Familiarity with connecting GenAI tools to internal data sources, APIs, and enterprise systems
- Ability to contribute reusable AI skills, templates, agent configurations, or automation workflows to a shared repository for team-wide use
- Willingness to learn and adopt new AI tools as they evolve; participation in AI adoption sprints, hackathons, and knowledge-sharing within the team

Preferred Certifications:

Certifications are a plus, not a substitute for demonstrated skill. Public research, CVEs and exploits carry equal or greater weight.

Preferred certifications / evidence

Exploit development & offensive:

OSCP, OSEP, OSED, OSWE, OSEE, OSCE³, GIAC GXPN, CRTO, CRTP/CRTE, HTB certifications

OT / ICS security:

GIAC GICSP, GRID or GCIP; ISA/IEC 62443 Cybersecurity Specialist/Expert; SANS ICS410/ICS515/ICS612 training

AI / LLM security:

AI red teaming certifications or training (e.g., HTB AI Red Teamer path, C-AI/MLPen), or published AI security research

Research track record

- CVE credits, vendor advisories, Pwn2Own/DEF CON-level CTF results, bug bounty rankings, conference talks

📌 Security Analyst (Chennai)
🏢 Securin
📍 Chennai