安全测试岗位职责

深入理解 ISO 26262 等汽车功能安全标准，熟练掌握危害分析与风险评估（HARA）、失效模式与影响分析（FMEA）、故障树分析（FTA）等功能安全分析方法。​
熟练使用 Vect工具（如 CANoe、CANape 等）进行汽车网络通信测试与分析，具备使用相关测试设备（如示波器、逻辑分析仪等）的实操经验。​
精通 C/C++、Python 等至少一种编程语言，能够独立开发测试脚本与自动化测试工具。​
熟悉汽车电子电气架构，了解车载网络协议（如 CAN、LIN、Ethernet 等）与通信机制。

【任职要求】
PCI安全工程师-硬件方向，需要按标准要求进行物理安全测试和物理攻击方案规划。有PCI-PTS物理评估经验或POS机硬件安全方案设计经验者优先。
The PCI Security Engineer (Hardware Focus) is required to conduct physical security testing devise physical attack scenarios as per standard requirements. Candidates with experience in PCI-PTS physical evaluations POS terminal hardware security solution design is a plus.
根据金融POS行业安全标准（如PCI-PTS等）对金融POS产品的硬件进行安全测试。
Conduct security testing on the hardware of financial POS products against dedicated security standards (e.g., PCI-PTS).
【任职要求】
大专以上学历，专业不限，主要看技能。
要求具备较好的动手能力。
基本的嵌入式系统软硬件调试和编程技能。
熟悉常见的加密算法原理和应用。
具备终端产品硬件安全、和/或物联网（IoT）方面的经验。
良好的英语水平（书面和口语），普通话为母语水平。
善于沟通和团队协作。
College degree above, no limitations to major.
Good hands-on skills are required.
Basic debugging programming skills fembedded system software hardware.
Familiar with the principles application of cryptographic algorithms.
Experience in hardware security of terminal products and/Internet of Things (IoT).
Good at English (written spoken), with native-level Mandarin.
Strong communication teamwork skills.
Technical Skills
能看懂并分析电路原理图。
熟练使用示波器、万用表、信号发生器等测试和信号采集设备。
具备硬件电路调试技能，会使用电烙铁、拆焊台等进行电路改装和修复。
熟悉至少一款嵌入式芯片的特性和典型应用。
了解AES、TDES、RSA、ECC等密码学算法的典型应用。
熟悉软件真实性和完整性验证的原理和方法。
了解金融POS机的软件和硬件保护原理。
了解故障注入、模糊测试等基本原理和方法。
熟悉产品开发和生产过程的安全管控措施及过程文档审核。
能读懂C语言编写的代码，会使用C语言或Python编程更佳。
Ability to analyze circuit schematics.
Proficient in using testing signal acquisition equipment such as oscilloscopes, multimeters, signal generators.
Possess hardware circuit debugging skills, capable of circuit debugging repair using soldering irons reverse-engineering stations.
Familiar with the characteristics typical applications of at least one embedded chip.
Understanding of the typical applications of cryptographic algorithms such as AES, TDES, RSA, ECC.
Familiar with the principles methods of software authenticity integrity verification.
Understanding of the protection principles fsoftware hardware in financial POS terminals.
Knowledge of basic principles methods such as fault injection fuzzing.
Proficient in C language, able to read code written in C, skilled in programming with C Python is preferred.

【岗位职责】
PCI安全工程师-软件方向，需要按标准要求进行金融POS机软件安全测试。有PCI-PTS、xPOC评估经验或POS机软件安全方案设计经验者优先。
The PCI Security Engineer (Software) is required to conduct software security testing ffinancial POS terminals as per standard requirements. Candidates with experience in PCI-PTS, xPOC evaluations, POS terminal software security design is a strong plus.
根据金融POS行业安全标准（如PCI-PTS等）对金融POS产品的软件进行安全测试。
Conduct security testing on the software of financial POS products in accordance with dedicated security standards (e.g., PCI-PTS).
【任职要求】
信息安全、网络安全、密码学、计算机科学与技术、通信工程或相关专业大学本科学历。
熟悉嵌入式系统软硬件调试和编程技能。
熟悉常见的加密算法原理和应用。
具备终端产品硬件安全、和/或物联网（IoT）方面的经验。
良好的英语水平（书面和口语），普通话为母语水平。
善于沟通和团队协作。
Bachelor’s degree in Information Security, Cybersecurity, Cryptography, Computer Science Technology, Communication Engineering, a related field.
Familiar with embedded system software hardware debugging programming skills.
Familiar with the principles applications of common encryption algorithms.
Experience in hardware security of terminal products and/Internet of Things (IoT).
Good at English (written spoken), with native-level Mandarin.
Strong communication teamwork skills.
精通C语言, 能熟练使用C语言、Python或java中的一种编程。
熟悉PCI PTS, ISO9564, ANSI X9.143, ANSI X9.24, TR-34 等标准。
熟悉主流对称和非对称密码学算法的原理和应用，熟悉密钥派生和管理方法。
熟悉Android、Linux等操作系统，了解内存隔离机制的实现，会熟练通过console、debug等接口进行系统安全性分析。
熟悉软件真实性和完整性验证的原理和方法，深刻理解固件和应用签名机制。
熟悉WiFi、Ethernet、Bluetooth 等网络协议，熟练使用数据包捕获、劫持和重放的工具进行测试和漏洞分析。
熟悉至少一款嵌入式芯片的特性和典型应用。
熟悉PKI原理和实际应用。
熟悉金融POS机的软件保护方案。
熟悉故障注入、模糊测试等原理和方法。
熟悉产品开发和生产过程的安全管控措施及过程文档审核。
了解POS机硬件安全的保护原理和方案。
Proficient in C language can program in one of the following: C, Python, Java.
Familiar with standards such as PCI-PTS, ISO9564, ANSI X9.143, ANSI X9.24, TR-34.
Familiar with the principles applications of mainstream symmetric asymmetric cryptographic algorithms, knowledgeable about key derivation management methods.
Familiar with operating systems such as Android Linux, understanding memory isolation mechanisms, skilled in conducting system security analysis via console, debugging interfaces, etc.
Familiar with the principles methods of software authenticity integrity verification, with a deep understanding of firmware application signing mechanisms.
Familiar with network protocols such as Wi-Fi, Ethernet, Bluetooth, proficient in using tools fpacket capture, hijacking, replay vulnerability analysis.
Familiar with the characteristics of at least one embedded chip.
Familiar with Public Key Infrastructure.
Familiar with software protection solutions ffinancial POS terminals.
Familiar with the principles methods of fault injection fuzzing.
Familiar with security control measures process documentation review during product development production.
Understanding of the protection principles solutions fPOS machine hardware security.