Job Title: Senior Product Security Architect
Work Arrangement: Hybrid 3 Days Onsite, 2 Days Remote
Location - Fremont, CA
Duration - 6+ Months (NO BENEFITS)
Job Overview
We are seeking a highly experienced Senior Product Security Architect to lead product security across hardware, embedded systems, firmware, and cloud-connected IoT products. This role will be responsible for designing and implementing security architectures, driving regulatory compliance, leading product security testing and certification, managing vulnerabilities, and coordinating with external penetration testers and security researchers.
The ideal candidate will have deep expertise in embedded security, ARM security architecture, secure boot, hardware root of trust, cryptographic key management, secure firmware updates, and IoT security standards. The candidate will work closely with firmware, hardware, cloud, and product engineering teams to ensure security is integrated throughout the product development lifecycle.
Key Responsibilities
1. Security Architecture and Hardware Root of Trust
Design and strengthen secure boot chains across embedded hardware platforms, including ARM Cortex-A, Cortex-M, and 8051-based systems.
Implement signed bootloaders, anti-rollback protection, verified boot, and secure provisioning mechanisms.
Design ARM TrustZone and TEE/OP-TEE architectures to isolate cryptographic operations and security-critical components.
Assess and secure JTAG/SWD debugging interfaces through production fuse configurations and authenticated debugging policies.
Define hardware root-of-trust architectures using secure elements, physically unclonable functions (PUFs), and hardware cryptographic accelerators.
2. Device Identity and Cryptographic Key Management
Manage the complete cryptographic key lifecycle, including manufacturing provisioning, rotation, revocation, and decommissioning.
Design secure device identity and authentication mechanisms for large-scale IoT deployments.
Develop and maintain mutual TLS and PKI infrastructures using per-device X.509 certificates and automated certificate lifecycle management.
Evaluate and improve encryption mechanisms for constrained embedded devices.
Implement hardware-backed key storage using secure elements, TrustZone secure storage, and eFuse technologies.
3. Secure OTA Updates and Firmware Hardening
Design secure over-the-air (OTA) firmware update architectures, including signed firmware images, encrypted delivery, A/B partitioning, anti-rollback enforcement, and fail-safe recovery.
Implement firmware compiler and binary hardening measures, including stack canaries, ASLR/PIE, RELRO, FORTIFY_SOURCE, and control-flow integrity.
Integrate static analysis, software bill of materials (SBOM) generation, and vulnerability scanning into firmware release processes.
Establish security requirements and release gates for third-party firmware components.
4. Regulatory Compliance and Product Certification
Lead technical compliance efforts for the EU Cyber Resilience Act (CRA) and applicable Radio Equipment Directive (RED) cybersecurity requirements.
Map regulatory requirements to technical controls and maintain compliance evidence, technical files, and certification documentation.
Coordinate with notified bodies, accredited testing laboratories, and internal engineering teams during conformity assessments.
Support security certification initiatives aligned with ETSI EN 303 645, IEC 62443, and other relevant embedded and IoT security standards.
Monitor evolving global cybersecurity regulations and translate requirements into actionable engineering roadmaps.
5. Product Security Testing
Define and lead security testing strategies across hardware, firmware, and communication protocol layers.
Conduct or coordinate static and dynamic analysis, fuzz testing, protocol testing, and hardware-level security assessments.
Evaluate hardware attack surfaces, including debug interfaces, side-channel vulnerabilities, and fault-injection risks.
Establish repeatable security test suites and release-gating criteria in collaboration with quality assurance and firmware engineering teams.
Track security testing schedules, certification milestones, and remediation activities.
6. Vulnerability Management and Security Response
Own product security incident response and vulnerability management processes (PSIRT).
Manage vulnerability intake, CVSS scoring, CVE tracking, remediation timelines, and security patch deployment.
Establish and maintain coordinated vulnerability disclosure processes for external security researchers.
Coordinate remediation activities across firmware, hardware, cloud, and product engineering teams.
Maintain vulnerability records and report security posture, remediation progress, and risk exposure to leadership.
7. External Penetration Testing and Research
Manage third-party penetration testing engagements, including scoping, test planning, access coordination, and remediation tracking.
Serve as the primary technical contact for independent security researchers and external testing organizations.
Evaluate penetration testing findings and drive issues through investigation, remediation, and closure.
Incorporate security findings into architecture improvements, secure design standards, and development processes.
8. Threat Modeling and Security Standards
Lead product-level threat modeling using STRIDE, PASTA, attack trees, and related methodologies.
Identify attack surfaces, abuse cases, security risks, and appropriate mitigation strategies.
Assess cyber-physical risks associated with safety-critical embedded systems and connected energy products.
Define and maintain security architecture standards, design patterns, and architecture decision records.
Conduct security design reviews for new products, features, and firmware updates.
9. Communication Protocol Security
Strengthen powerline communication (PLC) protocol security through authentication, encryption, replay protection, and secure key exchange.
Secure embedded Linux network interfaces, APIs, and production services by eliminating unnecessary exposure and enforcing authenticated access.
Define security requirements for CAN bus communication and BLE/Wi-Fi device provisioning.
Evaluate communication security across connected devices, gateways, batteries, controllers, and cloud platforms.
Required Qualifications
Bachelor's or master's degree in Computer Science, Electrical Engineering, Computer Engineering, or a related field.
12+ years of experience in product security, embedded security, IoT security architecture, or hardware security engineering.
Deep expertise in ARM security architecture, including TrustZone, Cortex-A TEE/OP-TEE, TrustZone-M, secure boot, and chain-of-trust design.
Hands-on experience with hardware root of trust, HSMs, TPMs, secure elements, and hardware cryptographic accelerators.
Strong knowledge of cryptographic key management, AES-128/256, RSA, ECC, TLS 1.2/1.3, mutual TLS, and X.509 PKI.
Production experience designing secure OTA update mechanisms, firmware signing, anti-rollback protection, and fleet-wide deployment strategies.
Experience with EU Cyber Resilience Act and/or RED Delegated Act cybersecurity compliance, conformity assessments, and certification documentation.
Experience managing product security response programs, vulnerability management, CVSS scoring, CVE handling, and coordinated vulnerability disclosure.
Experience managing third-party penetration testing and working directly with external security researchers.
Proficiency in C/C++ for embedded systems, including ARM Cortex-A, Cortex-M, and/or 8051-class platforms.
Experience with firmware compiler and binary hardening, static and dynamic analysis, and vulnerability scanning.
Demonstrated ability to lead threat modeling exercises and translate security findings into architecture decisions.
Working knowledge of IEC 62443, ETSI EN 303 645, EU Cyber Resilience Act, and NIST SP 800-183.
Strong communication and cross-functional leadership skills, with the ability to drive security outcomes across multiple engineering teams.
Preferred Qualifications
Experience securing powerline communication (PLC) protocols, including HomePlug, G3-PLC, or proprietary implementations.
Experience with CAN bus security, automotive-grade secure boot, or battery management system security.
Experience with manufacturing security provisioning, secure key injection, and device identity enrollment.
Knowledge of side-channel analysis, fault injection, and hardware tamper-resistance techniques.
Experience with SBOM generation tools such as CycloneDX and SPDX, along with software composition analysis.
Familiarity with energy-sector security standards and connected energy equipment.
Experience securing solar inverters, battery energy storage systems, grid-edge devices, or other safety-critical IoT products.
Prior technical leadership, team leadership, or experience building a product security program.
Relevant certifications such as CISSP-ISSAP, GICSP, OSCP, CCSP, or equivalent.
Core Technical Skills
Primary Skills: Product Security Architecture, Embedded Security, IoT Security, ARM TrustZone, Secure Boot, Hardware Root of Trust, Cryptography, PKI, TLS/mTLS, Secure OTA Updates, C/C++, Firmware Hardening, PSIRT, Threat Modeling, EU CRA, RED Delegated Act.
Secondary Skills: IEC 62443, ETSI EN 303 645, NIST SP 800-183, PLC Security, CAN Bus Security, SBOM, Static and Dynamic Analysis, Fuzz Testing, Penetration Testing, Vulnerability Management, Hardware Security Testing
