Product Security Engineer

We are looking for a Product Security Engineer with a strong background in software development software testing and security engineering to embed security into the product development lifecycle. The role will work closely with Product Engineering QA DevOps and Product Security teams to identify assess and remediate security risks across products.

The ideal candidate should be able to understand code design and execute security tests identify vulnerabilities and work directly with development teams to implement effective security controls.

• Integrate security practices into the Software Development Life Cycle (SDLC) from design through release.
• Perform security reviews of product architecture source code APIs and software components.

• Conduct security testing including:
  • SAST and SCA
  • DAST/API security testing
  • Vulnerability assessment
  • Fuzz testing
  • Penetration testing
  • Security regression testing
• Review and analyze vulnerabilities identified through security tools and testing activities.
• Work with developers to triage reproduce prioritize and remediate security vulnerabilities.
• Develop security test cases and automation to improve security testing coverage.
• Support implementation of secure coding practices and security controls within CI/CD pipelines.
• Participate in threat modelling and security risk assessments for new features and products.
• Review third-party and open-source components for security risks and support SBOM generation and maintenance.
• Support vulnerability remediation and security update processes throughout the product lifecycle.
• Investigate security defects and perform root-cause analysis to prevent recurrence.
• Support security requirements security acceptance criteria and release security assessments.
• Collaborate with Product Security Architect Product Security Specialist Developers QA DevOps and Product Managers to drive security improvements.
• Maintain evidence and documentation required for product security and regulatory compliance including EU Cyber Resilience Act (CRA) requirements.

• Bachelors or masters degree in cyber security Computer Science Information Security Software Engineering or a related technical discipline.

• 5 years of experience in software development application security or product security.
• Strong hands-on experience in at least one programming language such as C/C Java Python or JavaScript.
• Good understanding of software development lifecycle and testing methodologies.
• Strong debugging analytical and problem-solving skills.
• Ability to read and understand source code and work closely with developers on remediation.
• Experience with security testing tools such as SAST SCA DAST vulnerability scanners fuzzing tools and penetration-testing tools.
• Understanding of common application and product security vulnerabilities such as OWASP Top 10 CWE injection authentication/authorization issues memory vulnerabilities insecure configurations and cryptographic weaknesses.
• Experience with Git CI/CD pipelines and Dev SecOps practices.
• Understanding of threat modelling risk assessment vulnerability management and secure coding principles.
• Experience analyzing vulnerabilities using CVSS/CWE/CVE information.
• Good understanding of software composition analysis and open-source security.

• Experience with embedded products firmware hardware-software products or network/security products.
• Knowledge of SBOM formats such as SPDX or CycloneDX.
• Experience with tools such as Black Duck JFrog GitHub Advanced Security Coverity SonarQube Burp Suite OWASP ZAP or similar tools.
• Knowledge of cryptography TLS PKI secure boot code signing and key management.
• Experience implementing security controls in CI/CD pipelines.

• Security vulnerabilities identified early in the development lifecycle.
• Security testing integrated into CI/CD and product release processes.
• Timely remediation of product security vulnerabilities.
• Improved security test coverage and automation.
• Security requirements and threat-model findings addressed before product release.
• Accurate SBOM and vulnerability information maintained for products.
• Product security evidence available to support regulatory compliance requirements.