Cybersecurity Researcher Reverse Engineer

Job Summary Cybersecurity Researcher Reverse Engineer – Location: Golden, Colorado – Full‑time 40 hrs per week – Regular position at the National Laboratory of the Rockies (NLR). Job Description The National Laboratory of the Rockies (NLR) is seeking a skilled Cybersecurity Researcher Reverse Engineer to join our Cyber Threat Analysis Group within the Cybersecurity Research Center. This role requires candidates to analyze, deconstruct, and evaluate the security of highly complex embedded devices and systems critical to the nation’s energy infrastructure and national security. You will conduct deep‑dive vulnerability research on hardware and firmware found in Industrial Control Systems (ICS), smart grid components, electric vehicle supply equipment (EVSE), and distributed energy resources (DERs). Drawing on a comprehensive understanding of system internals, cryptography, and network protocols, you will reverse engineer proprietary systems to uncover zero‑day vulnerabilities, develop reliable exploits in constrained environments, and design system‑level mitigations to secure the energy grid against advanced persistent threats (APTs). Responsibilities Design and deploy advanced discovery techniques against black‑box embedded systems. Implement custom fuzzing harnesses for hardware‑in‑the‑loop and emulated environments. Develop robust, weaponized proof‑of‑concept (PoC) exploits for constrained environments. Bypass embedded exploit mitigations. Write custom shellcode and achieve persistent execution within RTOS or bare‑metal environments. Intercept, reverse engineer, and exploit communications across all layers. Analyze local hardware buses (CAN, I2C, SPI), industrial control protocols (Modbus, DNP3, IEC61850 GOOSE/SV, CIP/EtherNet/IP), and modern Smart Grid/EV protocols (OCPP, IEEE2030.5, MQTT). Perform static and dynamic analysis of compiled binaries, RTOS (e.g., VxWorks, QNX, FreeRTOS), and bare‑metal systems. Reverse engineer boot sequences, evaluate kernel‑level internals, and identify privilege escalation vectors from user‑space tasks to the kernel or hypervisor. Defeat hardware security mechanisms and extract firmware using debug interfaces (JTAG, UART, SWD). Execute advanced hardware attacks, including side‑channel analysis and fault injection (glitching), to extract cryptographic keys or bypass authentication. Translate highly technical vulnerability findings and exploitation mechanics into actionable intelligence. Brief technical peers, leadership, and federal stakeholders on systemic risks to critical infrastructure and propose hardware/software mitigations. Researcher IV Solves uniquely significant problems: defeats advanced hardware security mechanisms (Secure Boot, TrustZone) utilizing novel techniques like side‑channel analysis and fault injection; serves as a technical authority: briefs federal stakeholders and influences directorate‑level strategy; translates national needs: directly addresses national security priorities by developing advanced mitigations against APTs; drives lab‑wide capability: architects and maintains custom reverse engineering plugins and automation frameworks utilized by multiple teams; mentors at the lab level: serves as a recognized expert, mentoring staff across the organization in highly specialized areas like kernel‑level privilege escalation and deep firmware analysis. Researcher III Solves complex problems: develops robust PoC exploits and performs deep static/dynamic analysis on constrained embedded environments; leads project‑level decisions: designs and deploys advanced vulnerability discovery techniques, including custom fuzzing harnesses and symbolic execution; applies broad engineering concepts: adapts established principles to bypass exploit mitigations (e.g., ASLR, DEP/NX) on ARM, MIPS, and PowerPC architectures; coordinates project efforts: guides the technical execution of intercepting and analyzing complex hardware buses (CAN, SPI) and industrial protocols (Modbus, DNP3); represents the laboratory: translates highly technical vulnerability findings into actionable intelligence for internal peers and project leadership. Qualifications Researcher IV: Relevant PhD and 4+ years of experience, orrelevant Master’s Degree and 7+ years of experience, orrelevant Bachelor’s Degree and 9+ years of experience. Demonstrated in‑depth knowledge of laws, regulations, principles, procedures and practices related to the specific field. Excellent leadership, communication, problem‑solving and project management skills. Ability to use various computer software programs. Researcher III: Relevant PhD, orrelevant Master’s Degree and 3+ years of experience, orrelevant Bachelor’s Degree and 5+ years of experience. Demonstrates a broad understanding and wide application of engineering technical procedures, principles, theories and concepts. General knowledge of other related disciplines. Demonstrated leadership in one or more areas of team, task or project lead responsibilities. Experience in management of projects. Very good writing, interpersonal and communication skills. Must meet educational requirements prior to employment start date. Must be able to obtain and maintain a DOE security clearance at the DOE (Q) and SCI access or DoD (TS) and SCI level; SCI access may require a polygraph examination. Eligibility requirements: individual must be at least 18 years of age; U.S. Citizenship is required except in very limited circumstances. Benefits Summary Medical, dental, and vision insurance. Short‑term and long‑term disability insurance. Pension benefits. 403(b) Employee Savings Plan with employer match. Life and accidental death and dismemberment (AD&D) insurance. Personal time off (PTO) and sick leave. Paid holidays. Tuition reimbursement. Performance‑, merit‑, and achievement‑based awards that may include a monetary component. Possible relocation expense reimbursement. Limited‑term positions are not eligible for long‑term disability or tuition reimbursement. Equal Opportunity Employer All qualified applicants will receive consideration for employment without regard to age (40 and over), color, disability, gender identity, genetic information, marital status, domestic partner status, military or veteran status, national origin/ancestry, race, religion, creed, sex (including pregnancy, childbirth, breastfeeding), sexual orientation and any other applicable status protected by federal, state, or local laws. Reasonable accommodations are available. We participate in the E‑Verify system to achieve a lawful workforce. Security and Workplace Policies All employees must obtain and maintain a federal Personal Identity Verification (PIV) card per Homeland Security Presidential Directive 12 and undergo a favorable background investigation. The NLR is a Drug‑Free Workplace in accordance with the federal Drug‑Free Workplace Act; all applicants must pass a pre‑employment drug test. Job Application Information The anticipated closing window for application submission is up to 30 days and may be extended as needed. Salary ranges: Researcher IV $120,400–$216,700; Researcher III $100,400–$180,700. For more information please visit the NLR careers site. #J-18808-Ljbffr National Renewable Energy Laboratory