Indurex is an AI-native, engineering-first company dedicated to maintaining the resilience, safety, and security of complex cyber-physical systems. Our platform integrates safety, process, and cybersecurity data to provide context-aware, AI-scored incidents and actionable recommendations, enhancing existing SCADA/DCS, historians, and security tools. Based in Amsterdam, we collaborate with regional and global energy, manufacturing, utilities, data center, and pipeline operators to protect the systems that power and connect our world.

The Role

We are developing the first OT cybersecurity platform with decision logic and seek a candidate who can think like an attacker, transforming that mindset into labelled datasets, pcaps, logs, Suricata rules, and detection logic. This role is central to our product: the attacks you simulate will form the foundation for training and testing our ML models and agents.

Responsibilities

• Simulate realistic attack scenarios against IT and OT environments, including lateral movement, command injection, protocol replay, and man-in-the-middle attacks across OT protocols.
• Capture, label, and organize PCAPs and structured logs from each scenario to create the ground-truth dataset for detection models and agent evaluation.
• Write, test, and fine-tune Suricata detection rules based on your attack traffic, managing the feedback loop.
• Build and maintain the attack simulation lab, ensuring both on-prem hardware and cloud environments are clean, reproducible, and version-controlled.

Requirements

• Hands-on offensive security experience: CTF, red team, or penetration testing with a demonstrable portfolio.
• Knowledge of OT/ICS protocols: understanding how OT protocols (DNP3, Modbus, IEC 61850, etc.) operate at the packet level.
• Proficiency in PCAP analysis: using Wireshark, tcpdump, and Scapy for capture, analysis, and packet crafting.
• Experience in Suricata rule authoring: capable of writing signatures from scratch, not just modifying existing ones.
• Linux systems administration: comfortable managing lab infrastructure end to end.
• Familiarity with cloud infrastructure: AWS or Azure for deploying attack and detection environments at scale.
• Ability to thrive in a fast-paced environment.

Nice to Have

• Familiarity with MITRE ATT&CK for ICS; understanding of ICS-specific TTP taxonomy.
• Python scripting for automation tasks such as attack replay, log parsing, and rule generation.
• Experience with ICS-specific attack tools or vulnerability research.
• OSCP, CRTO, or equivalent certification.

If you are ready to take on this challenge, we would love to hear from you.