Product Security Architect - Fremont, CA - NM 26-14186

We are seeking a senior Product Security Architect to lead product security across hardware, embedded systems, firmware, and cloud-connected energy products. The role focuses on security architecture, regulatory compliance, security testing, and vulnerability management., * Architect secure boot chains across product hardware, including signed bootloaders, anti-rollback counters, eFuse/OTP provisioning, and verified boot.

• Design ARM TrustZone isolation and hardware Root-of-Trust solutions using secure elements, PUF-based identity, and hardware cryptographic accelerators.
• Audit JTAG/SWD debug interfaces and establish secure device identity and cryptographic key lifecycle management.
• Strengthen PLC encryption and device-to-cloud authentication using mutual TLS, PKI, and hardware-backed key storage.
• Design secure OTA update pipelines, firmware hardening, binary analysis, SBOM generation, and vulnerability scanning.
• Lead CRA and RED Delegated Act compliance, technical documentation, certification programs, and coordination with testing laboratories.
• Develop product security testing strategies covering static/dynamic analysis, fuzzing, protocol testing, and hardware-level testing.
• Manage PSIRT processes, CVE tracking, remediation SLAs, coordinated disclosure, and fleet-wide patching.
• Coordinate external penetration testing and security researcher engagements, ensuring findings are addressed through closure.
• Lead threat modeling and security design reviews, particularly for safety-critical battery and system-controller products.
• Secure PLC, CAN bus, BLE, Wi-Fi, and network interfaces across connected products.
• Establish security architecture standards and collaborate with firmware, hardware, cloud, QA, and product teams.

Role Highlights

• Ownership of product security architecture, testing, certification, and vulnerability management across a large deployed IoT energy portfolio.
• Opportunity to influence global energy infrastructure security and regulatory compliance.
• Direct engagement with security researchers and penetration-testing partners.
• Collaboration with experts in embedded systems, power electronics, hardware, and cloud platforms.
• Potential to grow into a team leadership role.

Security Architecture, Security Architecture, Embedded Systems, Regulatory Compliance, Computer Security, Computer Firmware, Cloud Computing, Embedded Hardware, Computer Engineering, Electrical Engineering, * Bachelor’s or master’s degree in Computer Science, Electrical Engineering, Computer Engineering, or a related field.

• 12+ years of experience in product security, embedded security, IoT security architecture, or hardware security engineering.
• Deep expertise in ARM security architecture, TrustZone (TEE/OP-TEE), secure boot, chain-of-trust design, and hardware Root of Trust.
• Hands-on experience with HSM, TPM, secure elements, cryptographic key management (AES-128/256, RSA, ECC), and hardware cryptographic accelerators.
• Strong knowledge of TLS 1.2/1.3, mutual TLS, X.509 PKI, certificate lifecycle management, and secure communication protocols.
• Production experience with secure OTA updates, firmware signing, encrypted delivery, A/B partitioning, anti-rollback, and fleet-scale deployment.
• Experience with EU Cyber Resilience Act (CRA) and/or RED Delegated Act compliance, technical documentation, conformity assessments, and testing laboratories.
• Experience managing PSIRT, CVSS scoring, CVE handling, coordinated disclosure, and remediation SLAs.
• Experience managing third-party penetration testing and engaging with security researchers.
• Proficiency in C/C++ for embedded systems, including ARM Cortex-A, Cortex-M, embedded Linux, RTOS, and 8051-class platforms.
• Knowledge of compiler and binary hardening, including stack protectors, ASLR/PIE, RELRO, control-flow integrity, and static/dynamic analysis.
• Experience leading threat modeling and translating findings into security architecture decisions.
• Familiarity with IEC 62443, ETSI EN 303 645, EU CRA, and NIST SP 800-183.
• Strong cross-functional collaboration skills across firmware, hardware, cloud, and product teams., * Experience securing PLC protocols, including HomePlug, G3-PLC, or proprietary PLC stacks.
• Experience with CAN bus security, automotive-grade secure boot, or battery management system security.
• Experience with secure manufacturing provisioning, device identity enrollment, and factory-line security.
• Knowledge of side-channel analysis, fault injection, and hardware tamper-resistance techniques.
• Experience with SBOM tools such as CycloneDX and SPDX, and firmware software composition analysis.
• Familiarity with energy-sector security standards and regulations.
• Experience securing solar inverters, battery energy storage systems, or grid-edge devices.
• Team leadership or people-management experience.
• Certifications such as CISSP-ISSAP, GICSP, OSCP, or CCSP.