FTTH Security Expert

P1 Security

. Plan and run scoped, authorized penetration tests of FTTH/PON infrastructure, including OLTs, ONTs/ONUs, ODN management systems, and customer premises equipment .

Posted 10/30/2026contractRemoteMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in penetration testing of FTTH/PON infrastructure, including firmware extraction and reverse engineering. Proficient in security audits, risk assessment, and remediation strategies within fixed-line network architecture.

Highest-signal resume keywords

Penetration TestingFirmware ExtractionSecurity Audit ExperienceRelevant CertificationsFixed-Line Network Architecture

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Penetration TestingFirmware ExtractionReverse EngineeringSecurity AuditsRisk AssessmentNetwork Architecture AnalysisSubscriber Provisioning SystemsAttack Path MappingDebug Interface AssessmentAdversary Emulation

Soft Skills

Presentation SkillsStakeholder Communication

Tools & Technologies

OLTONTCPESNMPNETCONFYANGSSHTelnetAPIsTR-069

Certifications & Qualifications

OSCPOSEPOSWEOSEDGPENGXPNGRIDCEH (Practical)EJPTECPPT

Industry Keywords

FTTHPONGPONXG-PONXGS-PONNG-PON23GPP SCASGSMA NESASISO/IEC 27001NIST CSF

About the role

Key responsibilities & impact

Plan and run scoped, authorized penetration tests of FTTH/PON infrastructure, including OLTs, ONTs/ONUs, ODN management systems, and customer premises equipment
Analyze GPON, XG-PON, XGS-PON, and NG-PON2 internals, including OMCI, PLOAM, ONT authentication, and provisioning
Perform firmware extraction and reverse engineering of CPEs and gateways
Assess UART/JTAG debug interfaces, hardcoded credentials, update mechanisms, and web/CLI management flaws
Assess subscriber provisioning and management systems including TR-069/CWMP, TR-369/USP, ACS/OSS/BSS integrations, and zero-touch provisioning
Review BNG/BRAS, PPPoE/IPoE, DHCP, RADIUS/AAA, VLAN segmentation, QoS, and subscriber isolation
Assess fixed–mobile convergence, including 5G FWA, shared core, shared OSS/BSS, unified identity, and billing
Review routers, switches, aggregation equipment, NMS/EMS, SNMP, NETCONF/YANG, SSH/Telnet, APIs, and privileged access against hardening baselines
Map attack paths using MITRE ATT&CK, GSMA FASG/FS.xx guidance, and MITRE FiGHT
Produce prioritized reports with proof-of-concept evidence, risk ratings, and actionable remediation
Present findings to stakeholders and support remediation verification and retesting
Contribute to internal tooling, test methodologies, lab environments, and reusable attack playbooks

Requirements

What you’ll need

Deep knowledge of fixed-line network architecture (FTTx, DSL, Coaxial)
Experience in security audit pentests on OT and IT infrastructure (mandatory)
Experience with Huawei, ZTE, Nokia, Ericsson, Calix, or Adtran FTTH equipment
Familiarity with 3GPP SCAS, GSMA NESAS, ISO/IEC 27001, NIST CSF, and ITU-T/BBF specifications
Experience in red teaming or adversary emulation against critical infrastructure
Fluent English speaker
French optional
Relevant certifications such as OSCP, OSEP, OSWE, OSED, GPEN, GXPN, GRID, CEH (Practical), eJPT/eCPPT, or CRTO
Telecom-specific training, such as GSMA, Black Hat/DEF CON telecom, or hardware trainings
Published research, CVEs, conference talks, or bug bounty history in telecom or embedded devices

Benefits

Comp & perks

Fully remote work policy
Monthly meetups with department members
Entire team on-site gathering every two months
Flexible work arrangements supporting work-life balance