Product Security Engineer

Overview

The Product Security Engineer is responsible for conducting comprehensive security assessments on various products, including mobile applications, IoT hardware/firmware, compiled software, and browser extensions. This role involves identifying vulnerabilities, developing mitigation strategies, and collaborating with cross-functional teams to enhance security. The engineer will use both offensive and defensive security tactics to safeguard products and manage third-party risk.

Technical (70%)

• Conduct comprehensive security assessments of mobile applications, IoT hardware / firmware, compiled software and browser extensions.

• Perform reverse engineering and vulnerability analysis, and penetration testing to uncover security risks.

• Analyze binary file formats (PE, ELF, Mach-O) and runtime behaviors for security flaws.

• Review browser extensions and software plugins for security flaws and compliance with best practices.

• Perform product data analysis to identify potential vulnerabilities and determine access scope.

Operational (30%)

• Collaborate with cross-functional teams (e.g. engineering, product, and security) to enhance security measures and improve resilience against cyber threats.

• Develop and recommend mitigation strategies and risk profiles for identified vulnerabilities.

• Document findings and communicate security recommendations to both technical and non-technical audiences.

• Maintain organizational product inventory with security assessment status and secure configuration requirements.

• Responsible for the production and maintenance of security documentation, such as bill of material repositories and analytical procedure guides.

• Bachelors of Science in a related field, such as Computer Science, Electrical Engineering, or Cyber Security

• 5-7 years of relevant experience in software exploitation, reverse engineering, malware analysis, or related field; or any equivalent combination of experience and training that provides the required knowledge, skills, and abilities needed to complete the primary job responsibilities

• Proficient in using debuggers, decompilers, and disassemblers to analyze code for vulnerabilities across various CPU architectures, including ARM and RISC-V.

• Strong understanding of binary file formats like PE, ELF, and Mach-O, enabling analysis of applications for security flaws

• Skilled in low-level data extraction and analysis using tools like QEMU and Verilog to identify and verify vulnerabilities through emulation

• Knowledgeable about Linux loaders, binary packing, and embedded systems tools such as Busy Box, binwalk, and u-boot

• Experienced in capturing and analyzing network traffic, including using tools like tcpdump and Scapy to dissect proprietary protocols

• Experienced in BOM enumeration and leveraging tools like Cyclone
  
  DX for inventory and risk assessment.

• Strong analytical and problem-solving skills, with a keen eye for identifying and mitigating security risks.

• Excellent communication skills for documenting findings, providing security recommendations, and effectively disclosing vulnerabilities to technical and non-technical audiences.

• Prior experience working in cybersecurity research or security assessment functions.

• Experience with application security testing and associated static and dynamic analysis tools.

• Knowledge of cryptographic principles and secure coding practices.

• Familiarity with security assessment frameworks and compliance standards.

• Prior experience with radio signals analysis and associated security hardening methodologies.

• Adaptable: Responds to change with a willingness to learn new ways to accomplish work objectives with a positive attitude.

• Innovative: Ability to develop, sponsor, or support the introduction of new and improved methods, products, procedures or technologies.

• Analytical and Critical Thinking: Ability to tackle a problem by using a logical, systematic, sequential approach.

• Problem Solving: Gathers and analyzes information to generate and evaluate potential solutions to problems, issues and challenges while weighing the accuracy and relevance of the facts, data…