IoT Security Specialist

Role Purpose & Context

Role Summary

The IoT Security Specialist is responsible for independently conducting security assessments on individual IoT devices and their entire ecosystem, from the silicon up to the cloud. You'll spend your days pulling apart devices, analysing firmware, and sniffing network traffic to uncover vulnerabilities that could put our customers or our business at risk. This role sits right at the heart of our product development cycle, making sure security is baked in, not bolted on, for our new connected products. When you do this job well, our products launch with fewer critical flaws, meaning happier customers and no embarrassing headlines about breaches. If it's not done properly, we're looking at potential data leaks, physical safety risks, and expensive product recalls – not ideal, is it? The challenge here is that every device is a new puzzle; there's no 'one-size-fits-all' solution, and you'll often be working with limited documentation. The reward? You get to play with cool tech, break things for a living, and truly protect millions of devices out in the wild.

Reporting Structure

• Reports to: Senior IoT Security Specialist
• Direct reports:
• Matrix relationships: Embedded Security Analyst, Device Security Engineer, Junior Hardware Hacker,

Key Stakeholders

Internal:

• Product Engineering Teams (firmware, hardware, cloud)
• Product Managers (for specific IoT devices)
• Quality Assurance (QA) Teams
• Legal & Compliance (for regulatory input)

External:

• Component Vendors (occasionally, for technical queries)
• Security Researchers (when coordinating disclosures)

Organisational Impact

Scope: This role directly impacts the security posture and market reputation of our IoT product lines. Your work prevents critical vulnerabilities from reaching production, safeguarding customer data, ensuring device reliability, and avoiding costly post-launch remediation efforts or regulatory fines. Frankly, you're a crucial line of defence.

Performance Metrics

Quantitative Metrics

1. Metric: Validated Findings per Assessment
2. Desc: The average number of confirmed, reproducible vulnerabilities (Severity Medium or higher) you identify and document per device security assessment.
3. Target: 8+ confirmed vulnerabilities (Medium or higher)
4. Freq: Per completed assessment (typically monthly/quarterly)
5. Example: After assessing the 'Smart Home Hub v2', you delivered a report detailing 12 unique, reproducible Medium-to-Critical vulnerabilities, including a firmware downgrade attack and an insecure API endpoint. That's a good result.
6. Metric: Time-to-PoC (Proof-of-Concept)
7. Desc: The average time it takes you to develop a working Proof-of-Concept exploit for a critical or high-severity vulnerability after its initial discovery.
8. Target: PoC within 72 hours of discovery for Critical/High findings
9. Freq: Per Critical/High finding
10. Example: You found a critical buffer overflow in the device's web server. Within 48 hours, you had a Python script demonstrating remote code execution, making it clear to engineering how serious it was.
11. Metric: Report Clarity & Actionability
12. Desc: The number of follow-up clarification requests from engineering teams regarding your assessment reports.
13. Target: < 3 requests for clarification per report
14. Freq: Per completed assessment report
15. Example: Your last report on the 'Connected Kettle' had zero questions from the firmware team because your steps-to-reproduce, evidence, and recommendations were so clear. That saves everyone time.
16. Metric: Assessment Throughput
17. Desc: The number of complete IoT device security assessments you independently conduct and deliver each quarter.
18. Target: 2-3 full device assessments per quarter (depending on complexity)
19. Freq: Quarterly
20. Example: In Q2, you completed full security assessments for the 'Smart Doorbell', 'Garage Opener', and initiated the 'Pet Feeder' analysis. That's hitting your stride.

Qualitative Metrics

1. Metric: Technical Depth of Analysis
2. Desc: Your ability to go beyond surface-level vulnerabilities, diving deep into firmware, hardware, and protocol specifics to uncover complex or novel attack vectors.
3. Evidence: Your reports consistently include detailed explanations of root causes (e.g., specific vulnerable code lines, hardware misconfigurations), not just symptoms. You're often the first to identify a non-obvious attack path, like a side-channel opportunity.
4. Metric: Collaboration with Engineering
5. Desc: How effectively you work with product and engineering teams to explain findings, discuss remediation strategies, and ensure security recommendations are practical and implemented.
6. Evidence: Engineering teams actively seek your input early in their design process. You're seen as a helpful partner, not just a blocker. You can translate complex security jargon into language developers understand and act on.
7. Metric: Proactive Learning & Skill Development
8. Desc: Your initiative in staying current with the rapidly evolving IoT threat landscape, new attack techniques, and relevant security tools.
9. Evidence: You regularly share interesting articles or new tools with the team. You're experimenting with new hardware hacking techniques in your spare time. You bring new ideas to team discussions about improving our security testing methodologies.
10. Metric: Documentation Quality
11. Desc: The clarity, accuracy, and completeness of your internal documentation, including test plans, tool configurations, and knowledge base entries.
12. Evidence: Other team members can easily follow your test procedures or replicate your findings using your documentation. Your internal wiki contributions are well-organised and up-to-date, making it easier for everyone.

Primary Traits

• Trait: The Systematic Tinkerer (Problem-solver)
• Manifestation: You're the kind of person who methodically takes apart a device, documenting every single step, even when it means 'bricking' a few along the way. You see a failed exploit attempt not as a setback, but as valuable data that gets you closer to the solution. You'll spend hours, maybe days, figuring out why something isn't working, rather than giving up. This isn't just about breaking things; it's about understanding *how* they break, piece by piece.
• Benefit: IoT security isn't about running automated scans and calling it a day. It's an exercise in finding novel ways to break bespoke hardware and software. You can't just run a standard tool; you often have to invent the attack path, and that requires relentless, structured persistence. Without this, you'll hit a wall quickly when faced with a new, undocumented device.
• Trait: The Forensic Analyst (Precise)
• Manifestation: When you write a report, every single finding is backed by irrefutable proof – we're talking packet captures, memory dumps, oscilloscope screenshots, and clear steps to reproduce. You never say a vulnerability is 'likely'; you prove it, beyond a shadow of a doubt. You're meticulous about labelling and organising all your evidence, because you know it's crucial. You'll re-read your own findings multiple times, just to make sure there's no ambiguity.
• Benefit: Your findings can trigger multi-million pound product recalls or stop a product launch dead in its tracks. The evidence you provide must be strong enough to convince skeptical engineering VPs, stand up to internal scrutiny, and potentially even legal challenges. There's simply no room for 'maybe' or 'probably' in this line of work; precision is paramount.
• Trait: The Relentlessly Curious (Self-directed)
• Manifestation: You're the person who spends their own time reading obscure microcontrollers' datasheets for fun. You order new smart-home gadgets just so you can take them apart and see how they work (and how they could be broken). You're active on security mailing lists and reverse-engineering forums, picking up new techniques without anyone telling you to. You're genuinely excited by a new vulnerability disclosure, not just because it's interesting, but because you want to understand it.
• Benefit: The IoT threat landscape, and the underlying hardware and software stacks, change quarterly, if not more often. There aren't always ready-made training courses for the latest zero-day vulnerabilities or new attack vectors. This role absolutely requires an innate, burning drive to learn constantly, because existing knowledge becomes obsolete surprisingly quickly. If you're not naturally curious, you'll fall behind.

Supporting Traits

• Trait: Pragmatic
• Desc: You can tell the difference between a really cool, theoretical hack and a genuine, high-impact business risk. You understand that not every vulnerability is equally urgent and can help prioritise.
• Trait: Articulate
• Desc: You can explain a complex buffer overflow in a BLE stack to a non-technical Product Manager without making their eyes glaze over. You can adapt your communication style to your audience.
• Trait: Patient
• Desc: You don't get flustered waiting six hours for a firmware dump to complete, or when a side-channel attack takes days to yield results. You understand that some things just take time.
• Trait: Ethical
• Desc: You have a deep, ingrained understanding of the responsibility that comes with finding flaws that could affect physical safety, privacy, or critical infrastructure. You always act with integrity.

Primary Motivators

1. Motivator: Solving Complex Puzzles
2. Daily: You thrive on the challenge of reverse-engineering undocumented protocols or finding a hidden debug port on a new device. Each assessment feels like a fresh puzzle to crack, and you genuinely enjoy the process of discovery.
3. Motivator: Tangible Impact on Security
4. Daily: You're motivated by knowing your work directly prevents real-world security incidents. Seeing a critical vulnerability you found get fixed before a product launch gives you a real buzz.
5. Motivator: Continuous Learning & Mastery
6. Daily: You're driven by the opportunity to constantly learn new attack techniques, explore different hardware architectures, and master new tools. The idea of becoming an expert in a niche, challenging field excites you.

Potential Demotivators

Honestly, this role isn't for everyone. You'll often be the bearer of bad news, telling engineering teams their brilliant new feature has a gaping security hole. You'll spend a fair bit of time trying to convince people that 'physical access' isn't a magical shield against all attacks. You'll also encounter a lot of 'black box' scenarios where vendors give you zero documentation, forcing you to spend days just figuring out the basics. If you need constant positive reinforcement or get easily frustrated by bureaucracy, you might struggle here.

Common Frustrations

1. The 'It's Behind a Firewall' Fallacy: Constantly battling the assumption from network teams that device-level security is unimportant because 'the network is secure'.
2. Vendor Indifference: Receiving a 'black box' device to secure with no source code, no schematics, and no support from the original manufacturer.
3. The BOM Cost Battle: Trying to justify an extra £0.10 per unit for a secure element chip to a management team obsessed with minimising the Bill of Materials (BOM) cost.
4. Proprietary Protocol Hell: Wasting weeks reverse-engineering a custom, undocumented protocol because a developer thought it was a 'secure' alternative to TLS.
5. The Physical Access Dismissal: Having a critical vulnerability downplayed because 'an attacker would need physical access', ignoring insider, supply chain, and 'evil maid' threats.

What Role Doesn't Offer

1. A predictable, routine 9-to-5 job – every day brings a new challenge, and some days are definitely longer than others.
2. A role where you only build things; you'll spend more time breaking and fixing than creating from scratch.
3. A role with immediate, high-level strategic influence – that comes later, after you've proven your technical chops.
4. A role where all the tools are perfectly documented and easy to use – you'll be wrestling with quirky hardware and command-line interfaces quite a bit.

ADHD Positives

1. The constant variety of new devices and attack surfaces can be highly engaging for those who thrive on novelty and diverse challenges.
2. Hyperfocus can be a superpower for deep dives into firmware analysis or complex protocol reverse engineering, allowing for sustained, intense concentration on a single problem.
3. The hands-on, tactile nature of hardware hacking (soldering, probing, physical manipulation) can be very stimulating and help maintain engagement.

ADHD Challenges and Accommodations

1. Documentation, while crucial, can feel tedious; we can offer templates and AI-assisted tools to streamline this process.
2. Switching between different projects or urgent requests might be challenging; clear prioritisation and dedicated 'deep work' blocks can help manage this.
3. Maintaining meticulous organisation of physical components (wires, adapters, devices) can be tricky; we provide organised lab spaces and clear labelling systems.

Dyslexia Positives

1. Strong spatial reasoning, often associated with dyslexia, is incredibly valuable for visualising complex hardware architectures and data flows in network protocols.
2. Excellent problem-solving skills, particularly in non-linear thinking, can help identify unusual attack vectors that others might miss.
3. The practical, hands-on nature of the work, focusing on physical manipulation and visual analysis (e.g., in `Ghidra` or `Wireshark`), can be a real strength.

Dyslexia Challenges and Accommodations

1. Reading and writing extensive technical reports can be demanding; we encourage the use of spell-checkers, grammar tools, and offer review by colleagues.
2. Parsing dense technical specifications or datasheets might require more time; access to text-to-speech software and visual aids can be provided.
3. Working with command-line interfaces where typos are unforgiving can be frustrating; IDEs with auto-completion and robust error messages are standard.

Autism Positives

1. A preference for logical, systematic work aligns perfectly with the methodical deconstruction and analysis required in IoT security.
2. Exceptional attention to detail is critical for spotting subtle anomalies in code, network traffic, or hardware configurations that others might overlook.
3. The ability to focus deeply on specific technical areas and master complex systems is highly valued in this specialisation.

Autism Challenges and Accommodations

1. Unpredictable social interactions or frequent context switching can be draining; we aim for clear communication, structured meetings, and predictable work patterns where possible.
2. Explaining complex technical findings to non-technical audiences might be challenging; we provide support in structuring presentations and offer opportunities for practice.
3. Sensory input in a lab environment (e.g., soldering fumes, equipment noise) can be intense; we offer quiet work areas, noise-cancelling headphones, and ensure good ventilation.

Key Responsibilities

Experience Levels Responsibilities

1. Level: IoT Security Specialist (Mid-Level)
2. Responsibilities: Independently conduct full security assessments on new and existing IoT devices, covering firmware, hardware, and network interfaces. This means getting hands-on with the actual device, not just running a scan.
3. Take ownership of the entire vulnerability discovery process for assigned devices, from initial reconnaissance and threat modelling to exploit development and detailed reporting. You'll be the one driving this.
4. Identify and document security vulnerabilities, providing clear, reproducible steps and actionable recommendations for engineering teams. Frankly, if they can't reproduce it, it's not a finding.
5. Propose and develop Proof-of-Concept (PoC) exploits for critical and high-severity findings to clearly demonstrate impact and urgency to developers. A working exploit speaks louder than words.
6. Analyse network traffic for proprietary IoT protocols using tools like `Wireshark` and `Scapy`, looking for weaknesses like insecure authentication or data leakage. This often means building custom dissectors.
7. Perform basic hardware analysis, which includes using `JTAG/UART` for console access, extracting firmware, and doing some initial probing with a logic analyser. Don't worry, we'll teach you the ropes if you're not a hardware wizard yet.
8. Contribute to our internal knowledge base by documenting new attack techniques, tool configurations, and common IoT security patterns. This helps everyone else, and future-you will be grateful.
9. Supervision: You'll typically have weekly check-ins with your Senior IoT Security Specialist to discuss progress, roadblocks, and tricky technical challenges. For routine tasks, you'll work independently, but for novel or complex problems, you're expected to escalate and collaborate.
10. Decision: You have the authority to choose the specific tools and methodologies for routine security assessments within established guidelines. You can make technical decisions on how to approach a specific vulnerability. Any significant changes to project scope, timelines, or budget (e.g., needing to order new specialist hardware above £500) need approval from your Senior Specialist.
11. Success: You'll be successful if you consistently deliver high-quality, actionable security assessment reports with minimal clarification requests from engineering. Finding and proving critical vulnerabilities, and helping the team fix them, is key. Your ability to work independently on core tasks and proactively seek help when needed will also define your success.

Decision-Making Authority

• Type: Tool Selection for Assessment
• Entry: Uses tools specified by supervisor; seeks approval for new tool use.
• Mid: Selects appropriate tools (e.g., `Ghidra` vs `IDA Pro` for RE) for routine assessments; consults Senior Specialist for novel tools or significant investment.
• Senior: Defines and standardises toolchains for specific assessment types; approves new tool adoption for the team.
• Type: Vulnerability Prioritisation
• Entry: Prioritises based on CVSS score and supervisor's guidance; escalates any ambiguity.
• Mid: Prioritises vulnerabilities based on CVSS, business impact, and exploitability; consults Senior Specialist for high-risk or complex cases.
• Senior: Defines and refines vulnerability prioritisation framework for product lines; makes final call on critical vulnerability impact assessment.
• Type: Assessment Scope Changes
• Entry: Escalates all scope change requests to supervisor for review and approval.
• Mid: Proposes minor scope adjustments for efficiency (e.g., focusing on one module over another based on initial findings); seeks approval from Senior Specialist.
• Senior: Approves significant scope changes within their workstream; negotiates scope with Product Management and Engineering leads.
• Type: Remediation Recommendation
• Entry: Suggests standard remediation options; supervisor reviews all recommendations.
• Mid: Independently proposes detailed, practical remediation strategies for most vulnerabilities; consults Senior Specialist for complex architectural fixes.
• Senior: Architects and validates complex remediation strategies; influences product roadmap for security improvements.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical wizardry, you'll need a solid set of foundational skills to really shine. These are the 'human' abilities that make you effective, whether you're explaining a complex bug or figuring out a tricky problem.

• Category: Communication & Collaboration
• Skills: Technical Report Writing: Crafting clear, concise, and evidence-backed reports that non-technical stakeholders can understand and technical teams can act on.
• Verbal Explanation: Articulating complex security concepts and vulnerabilities to diverse audiences, from engineers to product managers, adapting your language as needed.
• Active Listening: Truly understanding the concerns and constraints of engineering teams when discussing vulnerabilities and potential fixes.
• Cross-functional Teamwork: Working effectively with hardware, firmware, and cloud engineering teams to integrate security early in the development cycle.
• Category: Problem-Solving & Analysis
• Skills: Root Cause Analysis: Going beyond the symptom to identify the fundamental reason a vulnerability exists, whether it's a coding error, design flaw, or misconfiguration.
• Systematic Debugging: Methodically tracing execution flows, analysing memory, and using debugging tools to understand program behaviour and pinpoint vulnerabilities.
• Critical Thinking: Evaluating information from various sources (datasheets, code, network captures) to form a coherent understanding of a system's security posture.
• Pattern Recognition: Identifying recurring security anti-patterns or common vulnerabilities across different devices or codebases.
• Category: Adaptability & Learning
• Skills: Continuous Learning: Staying up-to-date with new IoT attack techniques, security research, and evolving hardware/software platforms.
• Resourcefulness: Finding solutions and information even when documentation is scarce or non-existent, often through experimentation and self-research.
• Comfort with Ambiguity: Operating effectively in situations where not all information is available, and you need to make educated guesses or assumptions.
• Resilience: Persisting through challenging technical problems, failed exploit attempts, and the occasional 'bricked' device without getting demotivated.

Functional Skills (Role-Specific Technical)

Here's where the rubber meets the road. You'll need a solid grasp of specific security methodologies, an understanding of how IoT systems actually work, and the tools to break them.

Technical Competencies

• Skill: Threat Modelling (STRIDE/PASTA)
• Desc: The ability to deconstruct an entire IoT ecosystem – device, firmware, radio protocol, gateway, cloud backend, mobile app – to identify and prioritise potential threats before a single line of code is written. You'll be looking at the whole picture.
• Level: Intermediate
• Skill: Secure Development Lifecycle (SDL) for Embedded Systems
• Desc: Understanding how to apply security gates and best practices (like static analysis or component analysis) within the unique constraints of resource-limited microcontrollers and real-time operating systems. It's not like securing a web app.
• Level: Intermediate
• Skill: Public Key Infrastructure (PKI) Fundamentals
• Desc: A solid grasp of how X.509 certificates work for secure device identity, authentication, and over-the-air (OTA) update signing. You don't need to manage millions yet, but you need to know the basics.
• Level: Intermediate
• Skill: Radio Frequency (RF) Security Analysis Basics
• Desc: A foundational understanding of the physical and MAC layers of common IoT protocols like BLE, Zigbee, and LoRaWAN, and how to identify basic weaknesses (e.g., sniffing, replay attacks).
• Level: Basic
• Skill: Hardware Security Mechanisms Awareness
• Desc: Familiarity with hardware features like Secure Boot, Trusted Execution Environments (e.g., ARM TrustZone), and Secure Elements (SEs). You should know what they are and why they matter, even if you're not designing them.
• Level: Basic

Digital Tools

• Tool: Ghidra (or IDA Pro)
• Level: Intermediate
• Usage: Reverse engineering firmware images to understand functionality, identify vulnerable code paths, and analyse proprietary protocols. You'll spend a lot of time here.
• Tool: Wireshark
• Level: Advanced
• Usage: Capturing, filtering, and deeply analysing network traffic for IoT protocols (MQTT, CoAP, custom ones). You'll be building custom dissectors and complex filters.
• Tool: nmap
• Level: Intermediate
• Usage: Network scanning to identify open ports, services, and device fingerprints on IoT devices and gateways. You'll be writing custom NSE scripts to find specific IoT services.
• Tool: JTAG/UART Adapters (e.g., Bus Pirate, FTDI)
• Level: Intermediate
• Usage: Gaining low-level console access to devices, dumping firmware, and interacting with debug ports. This is your gateway to the hardware.
• Tool: Metasploit / Burp Suite Community Edition
• Level: Intermediate
• Usage: Exploiting known vulnerabilities in device web interfaces and APIs, and intercepting/modifying HTTP/HTTPS traffic for web-based attacks.
• Tool: Python (with Scapy, pwntools)
• Level: Intermediate
• Usage: Scripting custom network attacks, fuzzing proprietary protocols, automating exploit development, and parsing binary data. This is your go-to scripting language.
• Tool: AWS IoT Core / Azure IoT Hub (Security Features)
• Level: Intermediate
• Usage: Auditing and assessing the security configurations (policies, certificates, device provisioning) of devices connected to cloud IoT platforms. You'll check if things are set up correctly.

Industry Knowledge

• Area: IoT Attack Surfaces
• Desc: A deep understanding of the common entry points and weaknesses in IoT ecosystems, including device firmware, hardware interfaces, communication protocols, cloud backend, and mobile applications.
• Area: Embedded Systems Basics
• Desc: Familiarity with microcontrollers, real-time operating systems (RTOS), memory architectures, and common embedded programming patterns. You need to know how these devices actually work.
• Area: Common IoT Vulnerabilities
• Desc: Knowledge of the OWASP IoT Top 10 and other prevalent security flaws specific to connected devices, such as insecure updates, weak authentication, or insecure default credentials.

Regulatory Compliance Regulations

• Reg: ETSI EN 303 645 (Consumer IoT Security)
• Usage: Applying the 13 baseline security provisions to assess consumer IoT products and identify gaps in their security implementation. You'll use this as a checklist.
• Reg: NISTIR 8259 (IoT Device Cybersecurity)
• Usage: Understanding and applying the core cybersecurity capabilities outlined by NIST for IoT devices, especially for identifying and documenting device security properties.

Essential Prerequisites

• At least 2 years of hands-on experience in security testing, penetration testing, or vulnerability research, ideally with some exposure to embedded systems or IoT.
• A solid grasp of networking fundamentals (TCP/IP, common protocols) and operating system internals (Linux is a must, especially embedded Linux).
• Proficiency in at least one scripting language for security tasks (Python is preferred, but strong C/C++ skills for reverse engineering are also highly valued).
• Experience with basic reverse engineering tools like `Ghidra` or `IDA Free` and a willingness to dive deeper.
• A proven track record of identifying and documenting security vulnerabilities in a clear, actionable manner.

Career Pathway Context

If you're coming from a general penetration testing background, you'll need to show a keen interest in hardware and embedded systems. If you're a firmware engineer looking to move into security, you'll need to demonstrate a hacker's mindset and a desire to break things. This role is a fantastic stepping stone for someone who's already got some security chops and wants to specialise in the exciting, challenging world of IoT.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: Prompt Engineering for Security AI
• Why: AI is already helping with code analysis, vulnerability research, and report drafting. Knowing how to ask the right questions and structure your prompts will be crucial to getting useful, accurate results from these tools, rather than just generic output.
• Concepts: [{'concept_name': 'Context Windows & Token Limits', 'description': 'Understanding how much information an AI can process at once and how to manage it for complex security queries.'}, {'concept_name': 'Temperature & Creativity', 'description': 'Knowing when to ask for precise, factual answers (low temperature) versus more exploratory, creative attack ideas (higher temperature).'}, {'concept_name': 'Output Validation & Hallucination Detection', 'description': 'Critically evaluating AI-generated findings, code, or reports for accuracy and identifying when the AI is making things up.'}, {'concept_name': 'Prompt Chaining for Complex Tasks', 'description': 'Breaking down a large security analysis task into smaller, sequential prompts to guide the AI through a multi-step process.'}]
• Prepare: This month: Start using tools like ChatGPT or Claude to help draft code comments, summarise research papers, or generate initial ideas for attack vectors.
• Next quarter: Experiment with more advanced prompt techniques, like role-playing (e.g., 'Act as a seasoned reverse engineer') or few-shot prompting.
• Month 3-6: Begin integrating AI-assisted code analysis tools into your workflow and critically review their findings against your manual analysis.
• Month 6-12: Share your best prompt engineering practices and any 'gotchas' with the wider team, helping us all learn.
• QuickWin: Start using AI to draft your daily stand-up updates or summarise long technical emails. It's a low-risk way to get comfortable with the tech.

Advancing Technical Skills

• Skill: Advanced Hardware Security Analysis
• Why: As software security improves, attackers are increasingly looking at hardware-level vulnerabilities. Understanding side-channel attacks, fault injection, and advanced physical tampering will become essential for truly robust device security.
• Concepts: [{'concept_name': 'Side-Channel Attacks (Power/EM)', 'description': 'Extracting cryptographic keys or sensitive data by analysing power consumption or electromagnetic radiation from a device.'}, {'concept_name': 'Fault Injection (Glitching)', 'description': "Temporarily disrupting a device's operation (e.g., voltage glitching, clock glitching) to bypass security mechanisms or extract data."}, {'concept_name': 'Secure Elements & Trusted Execution Environments', 'description': 'Deep dives into how these hardware features are implemented and how to verify their integrity and resistance to attack.'}, {'concept_name': 'PCB Reverse Engineering', 'description': 'Analysing circuit board layouts, identifying components, and understanding their interconnections to find potential attack points.'}]
• Prepare: This quarter: Read up on `ChipWhisperer` tutorials and basic side-channel theory. Order a cheap development board to experiment with.
• Next quarter: Attend a workshop or online course on hardware hacking or embedded security, focusing on physical attacks.
• Month 6-12: Set up a basic `ChipWhisperer` lab (we can help with equipment) and attempt a simple side-channel attack on a known target.
• Month 12-18: Start contributing to internal discussions on hardware security requirements for new product designs.
• QuickWin: Watch YouTube videos from Black Hat or DEF CON on hardware hacking. It's a great way to see what's possible and get inspired.
• Skill: Scalable PKI & Device Identity Management
• Why: As our device fleet grows into the millions, managing individual device identities and certificates becomes a huge challenge. You'll need to understand how to design and implement PKI solutions that scale without becoming a security nightmare.
• Concepts: [{'concept_name': 'X.509 Certificate Lifecycle Management', 'description': 'Understanding how certificates are issued, renewed, revoked, and managed at scale for millions of devices.'}, {'concept_name': 'Device Provisioning & Onboarding', 'description': 'Securely enrolling new devices into the network and assigning them unique, verifiable identities.'}, {'concept_name': 'Certificate Authority (CA) Operations', 'description': 'Understanding the role of internal or external CAs and best practices for their security and operation.'}, {'concept_name': 'Hardware Security Modules (HSMs)', 'description': 'How HSMs are used to protect cryptographic keys and secure CA operations.'}]
• Prepare: This quarter: Review our current device provisioning process and identify potential weaknesses in certificate handling.
• Next quarter: Take an online course on PKI fundamentals or enterprise certificate management.
• Month 6-12: Work with the cloud engineering team to audit existing `AWS IoT Core` or `Azure IoT Hub` certificate policies.
• Month 12-18: Propose improvements to our device identity management strategy for a new product line.
• QuickWin: Familiarise yourself with `OpenSSL` commands for generating and inspecting certificates. It's a basic but powerful skill.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree (or equivalent OFQUAL Level 5-6 qualification) in Computer Science, Electronic Engineering, Cyber Security, or a closely related technical field.
• Alts: We're pragmatic here. If you've got 4+ years of demonstrable, hands-on experience in embedded security, reverse engineering, or penetration testing, especially with a strong portfolio of personal projects or CTF achievements, we'd absolutely consider that in lieu of a formal degree. Show us what you can do!
• Level: Preferred
• Req: A Master's degree in Cyber Security, Embedded Systems Security, or a relevant specialisation.
• Alts: Relevant industry certifications (like OSCP, OSWE, or specific IoT security certs) combined with extensive practical experience can often be more valuable than a higher degree alone.

Experience Requirements

You'll need roughly 2-5 years of dedicated, hands-on experience in security roles. This isn't just about reading about security; it's about actually doing it. We're looking for folks who have spent time performing penetration tests, conducting vulnerability research, or reverse-engineering software/hardware. Experience with embedded systems, IoT devices, or industrial control systems (ICS) is a huge plus. We want to see that you've independently taken a device apart, found a bug, and proven it.

Preferred Certifications

• Cert: Offensive Security Certified Professional (OSCP)
• Prod: Offensive Security
• Usage: Demonstrates strong practical penetration testing skills, including exploit development, which is highly relevant for IoT device exploitation.
• Cert: Certified IoT Security Professional (CIoTSP)
• Prod: EC-Council
• Usage: Covers a broad range of IoT security domains, from device to cloud, validating a holistic understanding of the ecosystem.
• Cert: Hardware Hacking Training (e.g., from Black Hat/DEF CON)
• Prod: Various (e.g., Riscure, IOActive)
• Usage: Specialised training in physical attacks, side-channel analysis, or embedded system exploitation is incredibly valuable and directly applicable.

Recommended Activities

• Regularly participate in security conferences (like Black Hat, DEF CON, BSides) or local meetups to network and stay updated on the latest threats and techniques.
• Contribute to open-source security projects or personal hardware hacking projects to continuously hone your skills and build a portfolio.
• Subscribe to relevant security blogs, mailing lists (e.g., Full Disclosure, IoT security newsletters), and research papers.
• Actively engage in Capture The Flag (CTF) competitions, especially those focused on embedded systems or hardware challenges.
• Take online courses or workshops on advanced topics like reverse engineering, exploit development, or specific IoT protocols.

Career Progression Pathways

Entry Paths to This Role

• Path: Junior Penetration Tester / Security Analyst
• Time: 2-3 years
• Path: Embedded Software Engineer / Firmware Developer
• Time: 3-4 years
• Path: Security Consultant (with IoT exposure)
• Time: 2-4 years

Career Progression From This Role

• Pathway: Senior IoT Security Specialist
• Time: 3-5 years

Long Term Vision Potential Roles

• Title: Lead IoT Security Engineer
• Time: 5-8 years
• Title: Principal IoT Security Architect
• Time: 8-12 years
• Title: Director of Product Security
• Time: 10-15 years

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.