> Markdown version of [/jobs/ext/2714345-product-security-consultant](https://www.wearedevelopers.com/jobs/ext/2714345-product-security-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Product Security Consultant - **Company:** Blueprint School Network, Inc. - **Location:** Tewksbury, MA, United States - **Experience:** Expert - **Contract:** Temporary to permanent - **Skills:** Application Programming Interfaces (APIs), Software System Penetration Testing, User Authentication, Automation of Tests, Burp Suite, Software Debugging, Dynamic Program Analysis, Firmware, Fuzz Testing, Hardware Security Module, Joint Test Action (IEEE Standards), Linux System Administration, Wireless Security, Network Protocols, Nmap, Open Source Technology, OpenSSL, Reverse Engineering, Tripwire, Wireshark, Universal Asynchronous Receiver/Transmitter, Wi-Fi Technology, Data Logging, Software Security, IDA Pro, U-Boot, IoT Security - **Published:** September 4, 2026 - **Apply:** https://zappsec.applytojob.com/apply/QLvkdndgxl/Senior-Product-Security-Consultant?source=GS ## About the Role Mandatory: * Strong hands-on penetration testing and product security assessment experience across embedded systems, connected devices, and firmware security. * Experience with firmware extraction, unpacking, reverse engineering, binary analysis, dynamic analysis, and embedded security testing. * Familiarity with hardware/device attack surfaces, embedded system architectures, Linux-based systems, network protocols, and secure update mechanisms. * Ability to assess secure boot, firmware integrity, firmware trust chain, signing, rollback protection, secure update flows, filesystem security, bootloader security, and binary-level risks. * Experience testing authentication, authorization, encryption, TLS/certificates, cryptographic keys, hardware-backed key storage, device identity, secure elements, TPM, and TEE concepts. * Experience with exploitability validation, attack path analysis, protocol fuzzing, wireless security testing, and interface testing across UART, JTAG, SWD, USB, BLE, Wi-Fi, and proprietary protocols. * Hands-on experience using security testing and analysis tools such as Binwalk, Ghidra, IDA Pro, Radare2, OpenSSL, Burp Suite, Nmap, Wireshark, testssl.sh, Trivy, GDB, Frida, firmware emulators, protocol fuzzers, logic analyzers, and approved debug-interface tooling. Good to have: * Experience participating in CRA or regulated product security, or compliance-driven cybersecurity assessments * Experience participating in engagement related to export-controlled environments * Embedded or IoT security experience preferred Preferred Certifications * GXPN (Top Choice) * OSEP * Completed SANS training SEC556 (IoT Pen Testing) Years of Required Experience * 7-10 years in product security testing including device-level penetration testing * 10+ years in Product Security Testing firmware extraction, unpacking, and binary analysis ## Description * Hands-on technical product security assessment activities across the customer product ecosystem, including hardware and device penetration testing, firmware extraction and binary analysis, exploitability validation, secure update mechanism review, and embedded security assessment. * The role will cover UART/JTAG/SWD/USB, firmware extraction, binary analysis, reverse engineering, secure boot, signing, updates, rollback, authentication, encryption, secure defaults, logging, deletion and residual data. * Testing may extend to extends to BLE, Wi-Fi, web/API, companion applications and proprietary protocols, including controlled fuzzing. * The consultant will work under formal safety and restoration controls, validate exploitability and compensating controls, assess blast radius and containment, eliminate false positives, produce reproducible evidence and remediation guidance, and perform retesting. Key Responsibilities * Perform hardware and device-level penetration testing * Conduct firmware extraction, unpacking, and binary analysis * Assess secure boot, firmware integrity, rollback protection, and update mechanisms * Evaluate exposed interfaces (USB, network, wireless, serial/debug, administrative services) * Validate authentication, authorization, encryption, and secure configuration controls * Conduct exploitability validation, attack path analysis, and privilege escalation testing * Analyse attack surfaces to identify material security weaknesses across device components * Perform resilience testing and evaluate effectiveness of security controls * Test BLE, Wi-Fi, web/API, companion applications and proprietary protocols, including controlled fuzzing * Work with the Security architect to identify the test cases and the required open-source testing tools to perform the required IEC 62443 and EU CRA controls. * Lead the hardware security testing, authentication, authorization, encryption, and secure configuration controls and other active tools-based testing part of the engagement. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)