Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 7 hours agoWe saw it 116 min after it went up

Jr. Security Evaluator - Fault Injection

SGS4,616 open roles

Where
Barcelona, CT, Spain
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowJr. Security Evaluator - Fault InjectionSGS · Barcelona, CT, Spain

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on SGS's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. SGS postings stay open a median of 43 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 7 hours ago

SGS median: 43 days open

The posting

Company Description

SGS Brightsight is the world’s largest independent security evaluation lab, with accredited facilities across the globe. Our teams in Delft (The Netherlands), Barcelona and Madrid (Spain), Meyreuil (France), Beijing, Shanghai and Guangzhou (China), Singapore, and the USA are dedicated to helping companies ensure their products comply with the latest security regulations and requirements. With over 35 years of experience in evaluating IT products across various industries, we work at the forefront of security, evaluating products against stringent governmental and private standards.

At SGS Brightsight, our knowledge-driven environment is powered by professionals from diverse technical backgrounds. We pride ourselves on fostering an open, ambitious, and international atmosphere that values continuous growth. More information about our work can be found at SGS Brightsight: Security Evaluation Lab.

Job Description

One of the most powerful techniques to test a product's security is fault injection. Such attacks aim at modifying the circuit’s behaviour in order to access protected assets. Many types of fault injection attacks have been developed during the past decades, posing a critical threat for modern secured products. Fault Injection Security Evaluators use a wide range of attack methods to evaluate the security of a product.

The position

Fault injection attacks are performed in several steps, using various methods. Your daily activities involve (but are not limited to) cooperation with code and/or hardware reviewers to understand the product and its vulnerabilities, hands-on experiments in our lab, result analysis and reporting. As a Fault Injection Security Evaluator, you will be trained in these activities by an experienced colleague. Once fully trained, you will become an independent Evaluator. As attacks and products are constantly evolving, you will keep learning with the team.

Understanding the product

A fault injection test is usually one task of a larger evaluation project. These projects start with an implementation review (hardware and/or code) to identify potential vulnerabilities. This review is done by code and/or hardware reviewers who then create a test plan based on the identified vulnerabilities.

Your task starts by building an understanding of the product: its architecture, the vulnerability you are assessing, the target operation you need to attack, etc. Typically, this information is also part of the test plan and you will discuss this during the project with the rest of the team. Understanding the architecture of a microcontroller/smart card, crypto algorithms such as DES, AES, RSA, ECC etc., or payment protocols will be helpful to understand the product. This will be the first part of your training if you have no experience in this area.

Fault injection experiments

Once you have understood the product, you will prepare product samples for testing. This step can involve various preparation techniques like mechanical or chemical removal of packaging, chip thinning, the preparation of test circuit boards, etc. Skills like understanding and/or designing electronic circuits or experience with lab equipment like oscilloscopes will be helpful but they – as well as any skills needed to prepare the samples – will also be part of the training and are not mandatory.

Once the sample is prepared, you will need to write a test script (typically in JavaScript) which performs the attack on one of the various fault injection set-ups present at Brightsight. The techniques you will encounter include voltage manipulation (VM), body bias injection (BBI), electro-magnetic fault injection (EMFI) and light manipulation (LM) using various laser set-ups. During the second part of your training, you will learn how to prepare your sample and how to use all of our fault injection set-ups.

Analysis of the experiments results

As part of the experiments, you will assess the impact of the manipulation attempts performed e.g. by analyzing the response to a target command. You will need to determine whether the product you are attacking has activated countermeasures or whether you have successfully injected a fault. This is an iterative process, based on the results of several experiments for each of which you will actively choose the various parameters needed to thoroughly test the product. During this phase, you will discuss your results with the team and the code or hardware reviewer to understand better any unexpected activity you may observe.

Writing a report

As a final step, you will write a technical report to describe the experiments that you have performed as well as the results you have achieved. An important part of the report is your well supported conclusion with regard to the security of the product. The report must be understandable for internal and external entities, so it is important that you can determine what is important or not and have good writing skills in English.

Other activities

Besides the above-mentioned activities, fault injection security Evaluators are involved in the development of (hardware or software) tools and R&D of new attacks.

Qualifications

Job requirements

  • We are looking for people with a BSc or MSc degree in a technical field (Electronics, Physics, Electrical Engineering) with the potential ability to understand and perform the above-mentioned daily activities of Fault Injection Security Evaluators.
  • It is important that you like to work in a lab, with oscilloscopes, function generators, and other electronic equipment.
  • Having an analytic mind and being a good team player will be a plus.
  • Experience in circuit development and knowledge of fault injection attacks are helpful but not mandatory. Brightsight provides a full training program from basics to expert level. Therefore, your motivation, potential and attitude to analyse the products are most important.
  • This job also requires that you communicate knowledge convincingly, both orally and in writing, to internal and external entities.

The field of security evaluation is very broad, constantly on the move, and very exciting. We look forward to welcoming you to our team!

Additional Information

Why Join Brightsight?

  • Work on international projects in the field of security evaluation and certification.
  • Collaborate with highly skilled technical experts and Lead Evaluators.
  • Be part of a global Project Management team.
  • Develop your career in a growing and specialized industry.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against SGS's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on SGS's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    SGS's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.