Cybersecurity Researcher Reverse Engineer Security Clearance

Position: Cybersecurity Researcher Reverse Engineer with Security Clearance
The National Laboratory of the Rockies (NLR), located at the foothills of the Rocky Mountains in Golden, Colorado is the nation's primary laboratory for energy systems research and development. Join the National Laboratory of the Rockies (NLR), where world-class scientists, engineers, and experts are accelerating energy innovation through breakthrough research and systems integration. From our mission to our collaborative culture, NLR stands out in the research community for its commitment to an affordable and secure energy future.

Spanning foundational science to applied systems engineering and analysis, we focus on solving complex challenges to deliver advanced, secure, reliable, and cost-effective energy solutions. Our work helps strengthen U.S. industries, support job creation, and promote national economic growth. At NLR, you’ll find a mission-driven environment supported by state-of-the-art facilities, multidisciplinary research teams, and strong collaborations with industry, academia, and other national laboratories.

We offer robust professional development opportunities, and a competitive benefits package designed to support your career and well-being. This position is located in Colorado and requires the selected candidate to reside in Colorado. A hybrid work schedule is required, with regular weekly onsite presence. Relocation benefits are available. We are seeking a skilled Cybersecurity Researcher Reverse Engineer to join our Cyber Threat Analysis Group, within the Cybersecurity Research Center.

This role requires candidates to analyze, deconstruct, and evaluate the security of highly complex embedded devices and systems that are critical to the nation's energy infrastructure and national security. You will conduct deep-dive vulnerability research on hardware and firmware found in Industrial Control Systems (ICS), smart grid components, electric vehicle supply equipment (EVSE), and distributed energy resources (DERs). Drawing on a comprehensive understanding of system internals, cryptography, and network protocols, you will reverse engineer proprietary systems to uncover zero-day vulnerabilities, develop reliable exploits in constrained environments, and design system-level mitigations to secure the energy grid against advanced persistent threats (APTs).

Responsibilities include:

◦ Design and deploy advanced discovery techniques against black-box embedded systems. Implement custom fuzzing harnesses for hardware-in-the-loop and emulated environments. ◦ Develop robust, weaponized proof-of-concept (PoC) exploits for constrained environments. Bypass embedded exploit mitigations. Write custom shellcode and achieve persistent execution within RTOS or bare-metal environments. ◦ Intercept, reverse engineer, and exploit communications across all layers. Analyze local hardware buses (CAN, I2C, SPI), industrial control protocols (Modbus, DNP3, IEC 61850 GOOSE/SV, CIP/Ether Net/IP), and modern Smart Grid/EV protocols (OCPP, IEEE 2030.5, MQTT).

◦ Perform static and dynamic analysis of compiled binaries, RTOS (e.g., VxWorks, QNX, FreeRTOS), and bare-metal systems. Reverse engineer boot sequences, evaluate kernel-level internals, and identify privilege escalation vectors from user-space tasks to the kernel or hypervisor. ◦ Defeat hardware security mechanisms and extract firmware using debug interfaces (JTAG, UART, SWD). Execute advanced hardware attacks, including side-channel analysis and fault injection (glitching), to extract cryptographic keys or bypass authentication.

◦ Translate highly technical vulnerability findings and exploitation mechanics into actionable intelligence. Brief technical peers, leadership, and federal stakeholders on systemic risks to critical infrastructure and propose hardware/software mitigations Researcher IV: ◦ Solves uniquely significant problems:
Defeats advanced hardware security mechanisms (Secure Boot, Trust Zone) utilizing novel techniques like side-channel analysis and fault injection. ◦ Serves as a technical authority:
Briefs federal stakeholders and influences directorate-level strategy regarding systemic risks to critical infrastructure. ◦ Translates…