Sr. IoT/Cyber Security Specialist

Key Responsibilities: - Serve as subject matter expert for cyber/product security, providing technical design and architectural leadership. - Work closely with product and engineering teams to understand connected devices, document security architecture, attack surface, trust boundaries, and data flows. - Develop and maintain threat models, identify cybersecurity threats, and define security mitigations. - Identify and document product cybersecurity requirements, conduct risk analysis, verification and validation protocols. - Coach and mentor software and firmware development teams on security best practices. - Define, verify, and guide implementation of security mitigations. - Develop, maintain, and implement security policies, standards, and procedures across the organization. - Design and conduct cybersecurity risk assessments and tests, propose compensating controls. - Provide expertise on OWASP/CWE vulnerabilities, emerging threats, especially in the automotive domain. - Lead implementation of PKI, secure boot, secure communications, identity management, secure firmware updates, and configuration management. - Perform binary hardening, memory protection, radio security analysis, and reverse engineering activities. - Conduct penetration testing, vulnerability analysis, and use SCA/SAST/DAST tools. - Ensure compliance with standards such as ISO 27001/2, NERC, NIST, IEC 62443, GDPR, HIPAA, etc. What We're Looking For: - 7-12 years of experience, with at least 10 years in software engineering focused on secure product design. - Automotive industry experience preferred. - Strong knowledge of secure software development lifecycle, threat modeling, risk assessment, and security‑by‑design principles. - Hands‑on experience with threat modeling tools (e.g., SD Element) and penetration testing frameworks. - Proficiency with SCA, SAST, DAST tools, binary analysis, reverse engineering, and cryptographic implementations (PKI, AES, IPSEC, etc.). - Familiarity with UNECE security standards and internal communication protocols, JTAG, firmware extraction, etc. - Experience with cyber security standards (ISO 27001/2, NERC, NIST, IEC 62443, GDPR, HIPAA, etc.). - Programming experience in languages such as C/C++, Java, Python, etc. - Relevant security certifications (e.g., CISSP‑ISSEP, CISSP‑ISSAP, CEH, OSCP, CSSLP, GIAC, etc.) are a plus. - Strong communication skills, self‑driven, eager to learn, positive attitude, and problem‑solving mindset.