> Markdown version of [/jobs/ext/4625999-product-security-test-engineer-connected-devices](https://www.wearedevelopers.com/jobs/ext/4625999-product-security-test-engineer-connected-devices). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Product Security Test Engineer - Connected Devices

- **Company:** Anker Innovations LTD
- **Location:** Ontario, CA, United States
- **Experience:** Experienced
- **Salary:** $250,000
- **Contract:** Permanent contract
- **Skills:** Testing (Software), Application Programming Interfaces (APIs), Software System Penetration Testing, Communications Protocols, Software Debugging, Firmware, Fuzz Testing, Hardware Security Module, Python (Programming Language), Non-Volatile Memory, Cloud Services, Reverse Engineering, Traffic Analysis, Wi-Fi Technology, Software Security, Zigbee, IoT Security
- **Published:** November 7, 2026
- **Apply:** https://www.juju.com/job/28_25304_ca0101f5a92da829481656cfce9fc91d

## About the Role

* 4+ years in security testing, penetration testing, or security research
 * Hands-on testing experience - you've personally found and demonstrated vulnerabilities in systems you were authorized to test
 * Able to write your own tooling in Python, Go, or equivalent
 * Able to write a finding an engineer can act on without a follow-up meeting, * Hardware security assessment and firmware reverse engineering (Ghidra/IDA, fault injection)
 * BLE and wireless protocol testing
 * iOS/Android instrumentation and mobile hardening evaluation
 * Multi-tenant authorization flaws in cloud APIs
 * Stateful business-logic testing
 * CI-integrated security automation and fuzzing
 * Privacy traffic analysis.

## Description

We build connected home and personal devices used in households across the US. Our product security team's scope spans the full attack surface of those products - the devices themselves, the companion mobile apps, and the cloud services behind them., * Define test scope and pass criteria by product risk level, and assess release readiness

 * Scope and manage third-party penetration testing engagements, and review deliverables for technical rigor
 * Device and firmware testing: debug interface exposure, non-volatile storage and runtime memory analysis, firmware reverse engineering, and verifying that secure boot and rollback protections hold under attempted bypass
 * Wireless and provisioning testing: BLE pairing strength and downgrade resistance, credential exposure during Wi-Fi onboarding, Matter and Zigbee onboarding security
 * Mobile testing: decompilation, runtime instrumentation, certificate pinning resilience, local artifact audit, per-release third-party SDK traffic analysis
 * Authorization and access control testing across cloud APIs
 * Lifecycle testing across provisioning, sharing, ownership transfer, factory reset, and device resale
 * Convert findings into automated regression coverage in CI; build and run the device test lab
 * Privacy verification: field-level traffic analysis against approved data collection
 * Verifying cryptographic erasure and data removal at factory reset and end of life
 * Testing against consumer IoT security baselines including NIST IR 8425