Automotive Cybersecurity Test Engineer
北京掌上先机网络科技有限公司 • Shanghai, Shanghai, China
Salary: CNY 10,000 - CNY 20,000 / month
Role & seniority: Cybersecurity Verification & Penetration Testing Engineer (1–3 yrs experience; early-career/junior)
Stack/tools
-
Methodologies/standards: PTES, NIST SP 800-115, OWASP; TARA
-
Tools: Burp Suite, Metasploit, Nmap, Nessus, Wireshark, Scapy
-
Scripting: Python, Bash, PowerShell
-
Environments/OS: Linux, Windows
Top 3 responsibilities
-
Plan and execute security validation/verification & penetration tests on key ECUs, benches, and complete vehicles using recognized methodologies.
-
Conduct testing on core onboard controllers and integrated test networks; support full test coverage via test plan/methodology contributions.
-
Document findings with clear mitigation recommendations; collaborate with dev/ops to remediate vulnerabilities and learn internal tools/scripts.
Must-have skills
-
1–3 years cybersecurity experience; bachelor’s degree+ in CS/EE/security-related field.
-
Proficient English reading/writing; basic oral communication.
-
Ability to script (Python/Bash/PowerShell).
-
Strong understanding of at least one cybersecurity domain; good communication & teamwork; continuous learning.
Nice-to-haves
-
Linux/Windows security fundamentals; OWASP Top 10 and application security best practices.
-
Hands-on use of the listed security tools.
-
Automotive domain knowledge: ECU architectures and in-vehicle protocols (CAN, Automotive Ethernet, diagnostic).
-
Cryptography basics; experience with vehicle sec
Full Description
该职位来源于猎聘 Your Role
Perform verification and validation tests on key ECUs, bench and complete vehicle using recognized methodologies (PTES, NIST SP 800-115, OWASP);
使用公认的方法（PTES、NIST SP 800-115、OWASP）对核心车载控制器、集成台架和整车执行网络安全验证性测试和渗透测试；
Document findings and prepare clear reports with mitigation recommendations. Collaborate with development and operations teams to remediate vulnerabilities;
记录测试结果并撰写报告，分析并给出合适的修复建议；与开发和运维团队协作，修复漏洞；
Support the definition of test plans and methodologies to ensure full coverage;
协助制定测试计划和方法，以确保测试覆盖率；
Stay up to date on new techniques, tools, standards and trends in offensive security;
及时了解攻击性安全领域的新技术、工具、法规标准和发展趋势；
Under expert guidance, learn and use internal testing tools; develop testing tools and scripts.
在专家指导下，学习并使用内部测试工具；进行测试工具和脚本的开发
Support other teams for development and testing about cybersecurity topic
为其他开发测试团队提供网络安全方面的技术支持 Mandatory Qualifications
Bachelor's degree or above in Cyber Security, Computer Science, Software Engineering, Electrical Engineering, or a related field;
本科及以上学历，网络安全、计算机科学、软件工程、电气工程等相关专业；
1–3 years of working experience in cybersecurity;
1–3年网络安全工作经验；
Proficient in English reading and writing, with basic oral communication skills;
英语读写熟练，能够用英语进行基本交流。 Core Competencies
Ability to write scripts in Python, Bash, or PowerShell;
能够使用 Python、Bash 或 PowerShell 编写脚本；
Solid understanding of one or more cybersecurity domains (e.g., network security, application security, cryptography, etc.);
熟悉一个或多个网络安全知识域（如网络安全、应用安全、密码学等）；
Strong communication and teamwork skills;
良好的沟通能力和协作意识
Enthusiasm for continuous learning
持续学习意识 Better to have
Sound knowledge of operating systems (Linux, Windows), OWASP Top 10, and application security best practices;
扎实的操作系统（Linux、Windows）、OWASP Top 10 和应用安全实践知识；
Hands-on experience with security testing tools such as Burp Suite, Metasploit, Nmap, Nessus, Wireshark, and Scapy;
熟练使用 Burp Suite、Metasploit、Nmap、Nessus、Wireshark、Scapy 等测试工具；
Familiarity with automotive electronic architectures and in-vehicle communication protocols (CAN, Automotive Ethernet, diagnostic protocols, etc.);
了解汽车电子架构及车载通信协议（CAN/车载以太网/诊断协议等）；
Basic knowledge of cryptography and commonly used cryptographic algorithms;
具备密码学基础，熟悉常用的密码算法；
Experience in cybersecurity verification testing or penetration testing for vehicles;
具备车辆网络安全验证测试或渗透测试经验；
Understanding of TARA methodologies;
熟悉 TARA 威胁分析与风险评估方法。
