IoT Security Engineer

Insight Global

Saint Paul, MN, United States

3 days ago

Apply on www.techcareers.com

Prepare application

Role details

Contract type

Permanent contract

Employment type

Full-time (> 32 hours)

Experience level

Experienced

Experience required

3 years minimum

Working hours

Regular working hours

Job source

www.techcareers.com

Tech stack

Agile Methodology Software System Penetration Testing Booting (BIOS) Software Bug Management C++ (Programming Language) CAN Bus Code Review Cyber Security Computer Engineering Linux File Systems Embedded Software

+29 more

Firmware Hardware Security Module Joint Test Action (IEEE Standards) Network Security Modbus Open Web Application Security Package Development Process Scrum Methodology Program Analysis Real-Time Operating Systems Secure Coding Serial Communications Software Engineering Software Requirements Analysis Transmission Control Protocol (TCP) Universal Asynchronous Receiver/Transmitter Software Vulnerability Management EndPointSecurity SSL Certificate Management Data Logging Serial Peripheral Interface PIC Microcontroller Backend Information Technology Bare Metal U-Boot IoT Security Static Application Security Testing Dynamic Application Security Testing

Job description

Partner with stakeholders, product teams, and security teams to define secure system requirements for embedded firmware, IoT edge devices, gateways, and backend-connected components.
Design, develop, and test secure firmware and IoT software using secure-by-design principles, including authentication, authorization, secure communications, encryption, logging, and secure update mechanisms.
Implement hardware security controls including secure elements, TPMs, hardware root of trust, and JTAG/SWD lockdown.
Apply memory safety practices and compiler hardening techniques to mitigate common C/C++ vulnerabilities.
Develop secure device provisioning workflows including key injection, certificate enrollment, and device identity lifecycle management.
Integrate secure cloud to device communication patterns such as mutual TLS, token based authentication, certificate rotation, and secure onboarding using cloud to device security.
Lead vulnerability triage, root-cause analysis, remediation planning, patch development, verification, and release coordination for embedded and IoT software components.
Perform and support threat modeling, secure code reviews, static and dynamic analysis, dependency scanning, and security testing throughout the software development lifecycle.
Participate in embedded incident response, coordinated disclosure, and rapid hotfix development for fielded devices.
Design and implement secure OTA update pipelines including signing, encryption, rollback protection, A/B partitioning, and update integrity validation using secure OTA lifecycle best practices.
Integrate SAST, DAST, dependency scanning, and firmware specific security checks into CI/CD pipelines using secure CI/CD pipelines principles.
Collaborate with cross-functional teams, including hardware, software, product management, quality, regulatory, and external partners, to deliver secure connected products.
Stay current with cybersecurity standards, secure development practices, emerging vulnerabilities, tools, and techniques relevant to embedded systems and industrial IoT environments.

Requirements

Bachelor’s degree in Computer Engineering, Computer Science, Electrical Engineering, Cybersecurity, or a similar technical degree.
5 or more years’ experience in software or firmware development in a fast-moving product development environment.
3 or more years working in C or C++ for embedded firmware development.
Experience applying secure software development practices, including secure coding, code review, vulnerability remediation, and security defect management.
Experience with embedded RTOS or bare-metal development and security considerations for constrained devices.
Experience with serial communication protocols, such as UART, SPI, and I2C, and secure communication concepts for connected systems.
Experience with ARM-based microcontrollers, such as Microchip, NXP, Silicon Labs, or STMicroelectronics.
Experience with vulnerability management processes, CVE analysis, SBOM usage, dependency scanning, penetration test findings, and remediation verification.
Experience with cybersecurity frameworks or secure development standards such as NIST SSDF, IEC 62443, ISO 27001, OWASP, or secure product lifecycle practices.
Experience supporting embedded firmware platforms, board support package development, secure boot, secure storage, cryptographic services, or firmware update mechanisms.
Experience in one or more of the following areas: bootloaders, embedded file systems, Linux, CAN Bus, Modbus RTU, Modbus TCP, network security, device identity, or certificate management.
Experience with Agile development methodologies and integrating security activities into sprint planning, backlog management, release readiness, and defect triage.
Initiative and ability to work independently and as a member of a multi-disciplinary team while managing multiple security, development, or remediation priorities.
Strong communication skills, both verbal and written, with the ability to clearly explain technical security risks, remediation plans, and release impacts to technical and non-technical stakeholders.

Apply for this position

This job is hosted externally. Click below to view the full posting and apply.

Apply on www.techcareers.com

Prepare application

Good distractions

Loading talks and stories from around this role…