锦鲤求职岗位描述
Your Role
- Perform verification and validation tests on key ECUs, bench and complete vehicle using recognized methodologies (PTES, NIST SP 800-115, OWASP);
使用公认的方法（PTES、NIST SP 800-115、OWASP）对核心车载控制器、集成台架和整车执行网络安全验证性测试和渗透测试；
- Document findings and prepare clear reports with mitigation recommendations. Collaborate with development and operations teams to remediate vulnerabilities;
记录测试结果并撰写报告，分析并给出合适的修复建议；与开发和运维团队协作，修复漏洞；
- Support the definition of test plans and methodologies to ensure full coverage;
协助制定测试计划和方法，以确保测试覆盖率；
- Stay up to date on new techniques, tools, standards and trends in offensive security;
及时了解攻击性安全领域的新技术、工具、法规标准和发展趋势；
- Under expert guidance, learn and use internal testing tools; develop testing tools and scripts.
在专家指导下，学习并使用内部测试工具；进行测试工具和脚本的开发
- Support other teams for development and testing about cybersecurity topic
为其他开发测试团队提供网络安全方面的技术支持
Mandatory Qualifications
- Bachelor's degree or above in Cyber Security, Computer Science, Software Engineering, Electrical Engineering, or a related field;
本科及以上学历，网络安全、计算机科学、软件工程、电气工程等相关专业；
- 1–3 years of working experience in cybersecurity;
1–3年网络安全工作经验；
- Proficient in English reading and writing, with basic oral communication skills;
英语读写熟练，能够用英语进行基本交流。
Core Competencies
- Ability to write scripts in Python, Bash, or PowerShell;
能够使用 Python、Bash 或 PowerShell 编写脚本；
- Solid understanding of one or more cybersecurity domains (e.g., network security, application security, cryptography, etc.);
熟悉一个或多个网络安全知识域（如网络安全、应用安全、密码学等）；
- Strong communication and teamwork skills;
良好的沟通能力和协作意识
- Enthusiasm for continuous learning
持续学习意识
Better to have
- Sound knowledge of operating systems (Linux, Windows), OWASP Top 10, and application security best practices;
扎实的操作系统（Linux、Windows）、OWASP Top 10 和应用安全最佳实践知识；
- Hands-on experience with security testing tools such as Burp Suite, Metasploit, Nmap, Nessus, Wireshark, and Scapy;
熟练使用 Burp Suite、Metasploit、Nmap、Nessus、Wireshark、Scapy 等测试工具；
- Familiarity with automotive electronic architectures and in-vehicle communication protocols (CAN, Automotive Ethernet, diagnostic protocols, etc.);
了解汽车电子架构及车载通信协议（CAN/车载以太网/诊断协议等）；
- Basic knowledge of cryptography and commonly used cryptographic algorithms;
具备密码学基础，熟悉常用的密码算法；
- Experience in cybersecurity verification testing or penetration testing for vehicles;
具备车辆网络安全验证测试或渗透测试经验；
- Understanding of TARA methodologies;
熟悉 TARA 威胁分析与风险评估方法。