Sr. Product Security Engineer

Description

• Compliance & Standards: Interpret and enforce product security requirements, conduct vulnerability reviews, and ensure compliance with industry regulations and standards (IEC 62443, ISO 21434, NIST, etc.).
• Technical Guidance: Advise, guide, and mentor cross-disciplinary engineering teams during the design, review, and implementation of security features.
• Vulnerability Management: Identify, evaluate, and verify security issues discovered through automated testing, penetration testing, and customer feedback. Maintain and track closure of vulnerability backlogs.
• Security Tools Oversight: Monitor outputs and effectiveness from all security tools integrated within the software development lifecycle.
• Lead Security Activities: Apply the Secure Development Lifecycle and lead product security processes including architectural analysis, threat modeling, security DFMEA, penetration testing, attack modeling and simulation, and data privacy impact assessments.
• Prioritize engaging with customers. When not directly interacting with customers; collaborate with colleagues in your office
• Assurance: Validate that software meets all functional, security, regulatory (cybersecurity compliance), and quality benchmarks—particularly within industrial and transportation environments.
• Risk Management: Assess product security risks, develop comprehensive mitigation strategies, and evaluate technical and business trade-offs.

Requirements

• On-Site (5 days)
• Embedded Systems Experience: Demonstrated expertise in securing embedded controls platforms, with hands-on knowledge of Embedded Linux (e.g., Yocto) and RTOS environments (e.g., FreeRTOS, Zephyr Project, MicroC/OS-II).
• Security Analysis: Strong grasp of static analysis (SAST) and software composition analysis techniques for vulnerability detection and remediation.
• Bachelor’s or Master’s degree in computer engineering, computer science, electrical engineering or related technical field with 5+ years of experience.
• Preferred that the candidate have experience as an embedded product security engineer.
• DevOps & Automation: Familiarity with modern DevOps pipelines and tools (e.g., GitHub Actions, Azure DevOps, GitLab CI), with practical knowledge of automated testing frameworks (e.g., CppUTest).
• Connectivity Protocols: Preferred background in industrial communication protocols—CAN J1939, MQTT, OPC-UA, secure IP-based protocols, and Automotive Ethernet (100Base-T1, 10Base-T1S).
• Communication & Collaboration: Effective communicator with strong organizational skills, adept at working with cross-functional teams and presenting technical risks to varied audiences.
• Experience with embedded software development and proficiency in relevant programming languages (e.g., C, C++, C#, Rust, Python).
• Multi-region travel up to 5% may be required

Benefits

• Educational and training opportunities through company programs along with tuition assistance and student debt support.
• From Monday to Thursday, work onsite with your colleagues. On Fridays, choose your work location, balancing what your work requires
• Family building benefits include fertility coverage and adoption/surrogacy assistance.
• Benefits kick in on DAY ONE for you and your family, including health insurance and holistic wellness programs that include generous incentives – WE DARE TO CARE!
• 401K match up to 6%, plus an additional 2% core contribution = up to 8% company contribution.
• Paid time off, including in support of volunteer and parental leave needs.

Training + Development

Interview process

Visa Sponsorship

Security clearance