Senior Product Security Engineer

About This Role

This role involves securing embedded products, firmware, and industrial components throughout their lifecycle by applying firmware security, secure architecture, reverse engineering, and secure development lifecycle practices. The engineer will partner with engineering teams to enhance security controls in high-visibility industrial products used globally.

Responsibilities

• Design, review, and improve security controls for firmware, bootloaders, trusted hardware, and cryptographic modules
• Analyze firmware and binaries using tools such as Ghidra, IDA Pro, Binary Ninja, or similar
• Support secure coding practices for C/C++ and embedded operating systems
• Partner with architects and engineering leads to apply secure design principles and conduct architecture reviews
• Align engineering teams with secure development frameworks such as SSDF, DSOD, and secure lifecycle processes
• Support threat model components as part of the Secure Development Life Cycle process using frameworks like VAST, LINDDUN, IEC 62443, NIST 800-53/82, CAPEC, Emb3d, ATT&CK, OWASP and Common Criteria
• Identify attack surfaces, trust boundaries, misuse cases, and system risks, and evaluate SBOM, CVEs, CWE/CAPEC mappings
• Reproduce reported vulnerabilities using debugging, tracing, instrumentation, or reverse engineering techniques
• Contribute to secure build processes, CI/CD workflows, and automated testing, and support verification and validation of security controls
• Review ICS/OT interfaces and protocols such as CIP, CAN, SPI, I2C, UART/RS-485, IO-Link, and Modbus

Requirements

• Legal authorization to work in the U.S.
• Bachelor's degree in Computer Engineering, Computer Science, Electrical Engineering, or a related field

Qualifications

• Bachelor's degree in Computer Engineering, Computer Science, Electrical Engineering, or a related field
• Typically requires 8+ years of experience in embedded systems, firmware development, cybersecurity, or product security

Nice to Have

• Proficiency in C/C++, embedded operating systems, microcontrollers, Linux, Infrastructure as Code and device drivers
• Experience with secure boot, TPM, cryptography, and firmware signing
• Experience using debugging, tracing, or reverse engineering tools
• Experience performing vulnerability analysis or threat modeling
• Experience with industrial or real-time embedded systems
• Experience with IEC 62443, NIST 800-53, NIST 800-82, or Common Criteria
• Experience with fuzzing, dynamic testing, exploit analysis, or binary instrumentation
• Experience with secure build systems, CI/CD pipelines, or DevSecOps tools like Puppet, Ansible, Coverity, Blackduck, Jfrog, Cybeats, and Jenkins
• Knowledge of ICS protocols such as CIP, CAN, SPI, I2C, UART, Modbus, or IO-Link
• Security certifications such as CISSP, CSSLP, OSCP, GPEN, GREM, or IEC 62443
• Experience mentoring engineers or supporting security champions

Skills

* Required skills

Benefits