Embedded Product Security Engineer

We are looking for an experienced Embedded Product Security Engineer to strengthen the security posture of our embedded software products and development ecosystem. In this role, you will work at the intersection of embedded software engineering, cybersecurity, and DevSecOps, helping development teams build secure, compliant, and maintainable products.

You will be responsible for implementing and operating vulnerability management processes, integrating security tooling into CI/CD pipelines, supporting secure software supply chain practices, and collaborating closely with engineering teams across complex embedded environments.

This position requires strong hands-on expertise in embedded C/C++ ecosystems, static analysis, software composition analysis, SBOM management, and automation using modern DevSecOps practices.

Your Responsibilities

Build and maintain end-to-end vulnerability management processes, including:

• centralized vulnerability tracking,
• ownership assignment,
• traceability,
• CVE monitoring,
• triage and prioritization,
• false-positive management.

Configure, maintain, and optimize SAST and SCA tooling for embedded C/C++ projects using:

• Veracode,
• Veracode SCA,
• yocto-cve-check,
• and related security tooling.

Prepare embedded C/C++ codebases for static analysis by managing:

• preprocessing,
• compilation environments,
• debug symbols,
• and analysis requirements.

Generate and maintain Software Bills of Materials (SBOMs) using standards such as:

• CycloneDX,
• SPDX.

Integrate security controls and automated security gates into CI/CD workflows using:

• GitHub Actions,
• reusable workflows,
• composite actions,
• and infrastructure automation.

Support software repository migrations into GitHub from legacy platforms including:

• SVN,
• Bitbucket,
• GitLab.

Work across heterogeneous embedded environments and toolchains, including:

• Yocto,
• Buildroot,
• RTOS,
• bare-metal systems,
• CMake,
• Make,
• GCC ARM,
• IAR,
• vendor SDKs and HALs.

Develop automation and engineering tooling using:

• Python,
• Bash,
• Linux command-line environments.

Collaborate closely with software teams and technical stakeholders to:

• explain security findings,
• improve remediation workflows,
• and support secure development practices.

Contribute to secure software development lifecycle (SSDLC) initiatives and product compliance activities.

Requirements

Proven experience in:

• Product Security,
• DevSecOps,
• Secure Software Engineering,
• or Security Compliance.

Strong practical knowledge of:

• vulnerability management,
• SAST/SCA workflows,
• CVE monitoring,
• risk prioritization,
• and false-positive handling.

Hands-on experience with static and software composition analysis tools for C/C++ projects, especially:

• Veracode,
• Veracode SCA.

Experience preparing embedded C/C++ projects for automated security analysis.

Knowledge of SBOM generation standards and software supply chain security practices.

Experience integrating security tooling into CI/CD pipelines, preferably with GitHub Actions.

Strong GitHub experience, including repository administration and migrations from legacy VCS platforms.

Solid understanding of embedded software development environments, including:

• embedded Linux,
• RTOS,
• bare-metal firmware,
• cross-compilation toolchains,
• and embedded build systems.

Practical scripting and automation skills using:

• Python,
• Bash,
• Linux tooling.

Strong communication skills and ability to collaborate effectively across multidisciplinary engineering teams.

Ability to work independently in complex, legacy, or heterogeneous technical environments.

Nice to Have

Experience with:

• FreeRTOS,
• Zephyr,
• Buildroot,
• Yocto ecosystem security,
• firmware signing,
• secure boot,
• supply chain security frameworks.

Familiarity with:

• ISO 21434,
• IEC 62443,
• FDA cybersecurity guidance,
• or other product-security-related standards.

Experience supporting compliance or certification activities