Product Security Engineer
The Product Security Engineer is responsible for conducting comprehensive security assessments on various products, including mobile applications, IoT hardware/firmware, compiled software, and browser extensions. This role involves identifying vulnerabilities, developing mitigation strategies, and collaborating with cross-functional teams to enhance security. The engineer will use both offensive and defensive security tactics to safeguard products and manage third-party risk. This role contributes to the organization's mission by safeguarding the supply chain and managing third-party risk. Primary Accountabilities:
Technical (70%)
-
Conduct comprehensive security assessments of mobile applications, IoT hardware / firmware, compiled software and browser extensions.
-
Perform reverse engineering and vulnerability analysis, and penetration testing to uncover security risks.
-
Analyze binary file formats (PE, ELF, Mach-O) and runtime behaviors for security flaws.
-
Review browser extensions and software plugins for security flaws and compliance with best practices.
-
Perform product data analysis to identify potential vulnerabilities and determine access scope.
Operational (30%)
-
Collaborate with cross-functional teams (e.g. - engineering, product, and security) to enhance security measures and improve resilience against cyber threats.
-
Develop and recommend mitigation strategies and risk profiles for identified vulnerabilities.
-
Document findings and communicate security recommendations to both technical and non-technical audiences.
-
Maintain organizational product inventory with security assessment status and secure configuration requirements.
- Responsible for the production and maintenance of security documentation, such as bill of material repositories and analytical procedure guides.
Required Qualifications:
-
Bachelors of Science in a related field, such as Computer Science, Electrical Engineering, or Cyber Security
-
5-7 years of relevant experience in software exploitation, reverse engineering, malware analysis, or related field; or any equivalent combination of experience and training that provides the required knowledge, skills, and abilities needed to complete the primary job responsibilities
-
Proficient in using debuggers, decompilers, and disassemblers to analyze code for vulnerabilities across various CPU architectures, including ARM and RISC-V.
-
Strong understanding of binary file formats like PE, ELF, and Mach-O, enabling analysis of applications for security flaws
-
Skilled in low-level data extraction and analysis using tools like QEMU and Verilog to identify and verify vulnerabilities through emulation
-
Knowledgeable about Linux loaders, binary packing, and embedded systems tools such as BusyBox, binwalk, and u-boot
-
Experienced in capturing and analyzing network traffic, including using tools like tcpdump and Scapy to dissect proprietary protocols
-
Experienced in BOM enumeration and leveraging tools like CycloneDX for inventory and risk assessment.
-
Strong analytical and problem-solving skills, with a keen eye for identifying and mitigating security risks.
-
Excellent communication skills for documenting findings, providing security recommendations, and effectively disclosing vulnerabilities to technical and non-technical audiences.
Preferred Qualifications:
-
Prior experience working in cybersecurity research or security assessment functions.
-
Experience with application security testing and associated static and dynamic analysis tools.
-
Knowledge of cryptographic principles and secure coding practices.
-
Familiarity with security assessment frameworks and compliance standards.
-
Prior experience with radio signals analysis and associated security hardening methodologies.
Individual Competencies:
-
Adaptable: Responds to change with a willingness to learn new ways to accomplish work ob