Senior PSIRT Security Engineer, Embedded & Semiconductor Products (m/f/d)

NXP Semiconductors; Gratkorn; On-site; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Home office

Flexible working time

Meal benefits

More benefits

Job summary

NXP Semiconductors NV in Austria seeks a technical PSIRT member to analyze vulnerabilities across hardware, firmware, software, and embedded platforms. You will reproduce issues, assess exploitability, and draft remediation recommendations.

You will collaborate with product teams and researchers to validate findings, determine affected configurations, and document CVE records and advisories. Strong embedded/security experience and English fluency are essential.

Qualifications

• Experience in Product Security, Embedded Security, Semiconductor Security, Cybersecurity, or Secure Product Development.
• 3+ years of relevant work experience in a security related role.
• Bachelor’s/master’s degree in engineering – Computer Science, Electrical Engineering, Cybersecurity, or a related field.
• Strong experience in embedded security, hardware security, semiconductor security, firmware security, product security, or vulnerability research.
• Working knowledge of embedded architectures, microcontrollers, microprocessors, secure elements, firmware, boot chains, hardware security features, and low-level software.
• Ability to analyze vulnerability reports and reason about attack prerequisites, privilege boundaries, exploitability, and product impact.
• Experience with one or more relevant technical areas such as C/C++, assembly, reverse engineering, firmware analysis, secure boot, cryptography, debug interfaces, hardware‑assisted security, fault injection, or side‑channel analysis.
• Familiarity with vulnerability classification, CVE, CVSS, CWE, coordinated disclosure, and security advisory development.
• Experience in automotive, industrial, IoT, mobile, secure identification, connectivity, or communication‑infrastructure products is advantageous.
• Excellent collaboration and communication skills to work effectively with cross‑functional teams.
• Fluent in English

Responsibilities

• Analyze vulnerability reports and assess exploitability, scope, and customer impact.
• Reproduce issues with product teams and validate findings.
• Determine affected product families, configurations, versions, and usage scenarios.
• Document technical rationale for severity and remediation decisions.
• Prepare CVE records, security advisories, and researcher communications.
• Engage with researchers to clarify findings and validate disclosures.
• Advise teams on vulnerability patterns and security engineering improvements.
• Promote best practices in vulnerability management and PSIRT processes.
• Improve PSIRT processes, metrics, and operational excellence.
• Collaborate across product teams and security functions to reduce risk

Skills

Product security

Embedded security

C/C++

Reverse engineering

Firmware analysis

Vulnerability analysis

Low-level software

Security disclosure

Cross-functional collaboration

English fluency

Education

Bachelor’s/Master’s in Engineering

Job description

As a technical member of NXP’s Product Security Incident Response Team, you will analyze reported vulnerabilities affecting hardware, firmware, software, and embedded product platforms. You will work with product subject matter experts to reproduce issues, determine technical impact, identify affected configurations, assess exploitability, and develop technically sound mitigation or remediation recommendations.

What you'll do:

• Perform technical triage of vulnerability reports affecting NXP hardware, firmware, software, development tools, and embedded platforms.
• Analyze vulnerability prerequisites, attack paths, trust boundaries, affected components, and potential customer impact.
• Work with product teams to reproduce reported behavior and validate findings.
• Determine affected product families, configurations, software versions, and customer usage scenarios.
• Assess exploitability and severity using available technical evidence and applicable scoring methodologies.
• Document the technical rationale supporting severity, scope, affected product, and remediation decisions.
• Provide technically precise content for CVE records, security advisories, customer communications, and researcher responses.
• Engage directly with security researchers to clarify findings, request evidence, and validate coordinated disclosure materials.
• Advise product teams on recurring vulnerability patterns and opportunities to improve product-security engineering.
• Act as a trusted advisor to product teams on vulnerability management and product security best practices.
• Continuously improve PSIRT processes, metrics, and operational excellence.

What You'll Bring

• Experience in Product Security, Embedded Security, Semiconductor Security, Cybersecurity, or Secure Product Development.
• 3+ years of relevant work experience in a security related role
• Bachelor’s/master’s degree in engineering – Computer Science, Electrical Engineering, Cybersecurity, or a related field.
• Strong experience in embedded security, hardware security, semiconductor security, firmware security, product security, or vulnerability research.
• Working knowledge of embedded architectures, microcontrollers, microprocessors, secure elements, firmware, boot chains, hardware security features, and low-level software.
• Ability to analyze vulnerability reports and reason about attack prerequisites, privilege boundaries, exploitability, and product impact.
• Experience with one or more relevant technical areas such as C/C++, assembly, reverse engineering, firmware analysis, secure boot, cryptography, debug interfaces, hardware‑assisted security, fault injection, or side‑channel analysis.
• Familiarity with vulnerability classification, CVE, CVSS, CWE, coordinated disclosure, and security advisory development.
• Experience in automotive, industrial, IoT, mobile, secure identification, connectivity, or communication‑infrastructure products is advantageous.
• Excellent collaboration and communication skills to work effectively with cross‑functional teams.
• Fluent in English

Benefits

• home office, flexible working time, meal benefits and more.

Understand Threats. Protect Products. Protect Customers. Lead Response. Reduce Risk. Build Trust. Drive Security. Create Impact. Shape Tomorrow.

For Austrian applicants: NXP provides market competitive compensation according to the benchmarking of the electronic and semiconductor industry. Due to the Austrian Equal Treatment Act we are obligated to state the employment group of our applicable collective bargaining agreement (CBA) “Kollektivvertrag für Angestellte Gewerbe und Handwerk und in der Dienstleistung“, this position (fulltime) is graded in Employment Group V. Your individual experiences and expectations will be considered in the application process. Moreover, we provide attractive benefits to our employees like home office, flexible working time, meal benefits and more.

More information about NXP in Austria...