Product Security Engineer, Embedded / IoT

Job Title

Product Security Engineer, Embedded / IoT

Role Summary

Assess and secure embedded systems and IoT products across hardware, firmware, and software layers. Perform product security assessments, VAPT, threat modeling, and support SSDLC activities.

Work with hardware, firmware, software, and product teams to identify vulnerabilities, recommend practical mitigations, and validate remediation.

Experience Level

Mid-level. Targeted experience range: 2 to 10 years in product security, embedded security, or IoT security assessments.

Responsibilities

Deliver technical security assessments and documentation across the product lifecycle.

• Review product architecture, hardware/firmware designs, interfaces, and deployment environments to identify assets and attack surfaces.
• Plan and execute hardware and firmware VAPT using black-box, grey-box, and white-box approaches.
• Perform firmware extraction, unpacking, filesystem and binary analysis, and source code review when applicable.
• Develop and maintain threat models, security requirements, test plans, and traceability records.
• Validate security controls such as secure boot, signed firmware, rollback protection, credential handling, and secure communications.
• Analyze SAST/SCA/SBOM outputs, prioritize findings, and eliminate false positives.
• Prepare technical reports with evidence, risk ratings, and actionable remediation; verify fixes with engineering teams.
• Create reusable test scripts, procedures, and checklists; monitor newly disclosed vulnerabilities affecting products.

Requirements

Must-have technical skills and practical experience for embedded/IoT product security roles.

• 2–10 years experience in product security, embedded security, or IoT security assessments.
• Strong understanding of embedded product architecture: MCUs/processors, bootloaders, memory, storage, and embedded Linux or RTOS.
• Hands-on with hardware debug/programming/communication interfaces: UART, JTAG/SWD, SPI, I2C, USB; firmware acquisition and flash access.
• Firmware and binary analysis skills: extraction, unpacking, filesystem analysis, reverse engineering, and identifying exposed secrets or insecure update mechanisms.
• Practical experience conducting manual and tool-assisted testing of devices, validating vulnerabilities and demonstrating impact safely.
• Knowledge of secure boot, firmware signing, OTA updates, rollback protection, key storage, certificate management, and secure communications.
• Familiarity with networking and IoT protocols: Ethernet, Wi‑Fi, BLE, CAN, MQTT, HTTP(S), TLS; traffic capture and analysis.
• Ability to read C/C++ and write or modify Python or shell scripts.
• Experience with tools such as Ghidra/IDA, Binwalk, GDB, OpenOCD, Wireshark, Nmap, flash programmers, debug probes, and logic analyzers.
• Experience with SAST, SCA, and SBOM analysis and prioritization.

Education Requirements

Not specified.

About the Company

Company: eInfochips

Headquarters: Bengaluru, India

eInfochips is a product engineering and semiconductor design services company offering embedded software, SoC design and verification, testing, and IoT solutions. It operates as part of Arrow Electronics, serving clients across industries worldwide.