Product Security Engineer

• Review and analyze vulnerabilities identified through security tools and testing activities.
• Work with developers to triage, reproduce, prioritize, and remediate security vulnerabilities.
• Develop security test cases and automation to improve security testing coverage.
• Support implementation of secure coding practices and security controls within CI/CD pipelines.
• Participate in threat modelling and security risk assessments for new features and products.
• Review third-party and open-source components for security risks and support SBOM generation and maintenance.
• Support vulnerability remediation and security update processes throughout the product lifecycle.
• Investigate security defects and perform root-cause analysis to prevent recurrence.
• Support security requirements, security acceptance criteria, and release security assessments.
• Collaborate with Product Security Architect, Product Security Specialist ,Developers, QA, DevOps, and Product Managers to drive security improvements.
• Maintain evidence and documentation required for product security and regulatory compliance, including EU Cyber Resilience Act (CRA) requirements.

Qualifications

Education

• Bachelor’s or master’s degree in cyber security, Computer Science, Information Security, Software Engineering, or a related technical discipline.

Required Experience and Skills

• 5+ years of experience in software development, application security, or product security.
• Strong hands-on experience in at least one programming language such as C/C++, Java, Python, or JavaScript.
• Good understanding of software development lifecycle and testing methodologies.
• Strong debugging, analytical, and problem-solving skills.
• Ability to read and understand source code and work closely with developers on remediation.
• Experience with security testing tools such as SAST, SCA, DAST, vulnerability scanners, fuzzing tools, and penetration-testing tools.
• Understanding of common application and product security vulnerabilities such as OWASP Top 10, CWE, injection, authentication/authorization issues, memory vulnerabilities, insecure configurations, and cryptographic weaknesses.
• Experience with Git, CI/CD pipelines, and Dev SecOps practices.
• Understanding of threat modelling, risk assessment, vulnerability management, and secure coding principles.
• Experience analyzing vulnerabilities using CVSS/CWE/CVE information.
• Good understanding of software composition analysis and open-source security.

Good to Have

• Experience with embedded products, firmware, hardware-software products, or network/security products.
• Knowledge of SBOM formats such as SPDX or CycloneDX.
• Experience with tools such as Black Duck, JFrog, GitHub Advanced Security, Coverity, SonarQube, Burp Suite, OWASP ZAP, or similar tools.
• Knowledge of cryptography, TLS, PKI, secure boot, code signing, and key management.
• Experience implementing security controls in CI/CD pipelines.

Key Deliverables / Success Measures

• Security vulnerabilities identified early in the development lifecycle.
• Security testing integrated into CI/CD and product release processes.
• Timely remediation of product security vulnerabilities.
• Improved security test coverage and automation.
• Security requirements and threat-model findings addressed before product release.
• Accurate SBOM and vulnerability information maintained for products.
• Product security evidence available to support regulatory compliance requirements.