Senior Product Security Engineer

Montash; Deutschland; Hybrid; EUR 120.000 - 160.000; Vollzeit

Zusammenfassung

Montash is seeking a Senior Product Security Lead to establish and own the security function for a growing IoT hardware company. You will oversee security across embedded/firmware and cloud APIs, shaping secure-by-design practices and regulatory alignment.

You will drive threat modeling, CRA/NIS2 compliance, and mature tooling, while mentoring developers and harmonizing security approaches across teams.

Qualifikationen

• Hands-on product/application security across embedded IoT and cloud/API.
• Strong threat modeling and architecture risk assessment background.
• Familiarity with CRA, NIS2 and translating regs into engineering requirements.

Aufgaben

• Serve as the security lead across embedded/firmware and cloud domains.
• Drive secure-by-design practices in hardware, apps, and services.
• Lead threat modeling and risk assessments for new architectures.
• Define and implement CRA and NIS2 compliance documentation.
• Introduce and mature security tooling and standardize practices.
• Upskill developers and guide security governance with technical depth.

Kenntnisse

Product security

Embedded systems

Cloud security

Threat modeling

Regulatory compliance

Security tooling

Communication skills

Coding ability

Tools

SAST

SCA

SBOM tooling

Secret detection

Jobbeschreibung

Location: Remote-friendly (Germany-based preferred, occasional on-site time appreciated)

Employment type: Full-time

About the Role

On behalf of our client, a growing IoT hardware company building connected smart home products that combine embedded devices, mobile apps, and cloud infrastructure, we're looking for their first-ever dedicated product security hire. This is a true opportunity to build the security function from the ground up.

Our client is seeking a senior, hands-on professional for a role with broad scope: acting as a security overlay across their development teams (no dedicated security team exists yet), setting the secure-by-design foundation for everything from RF communication and embedded firmware to cloud APIs and infrastructure, working closely with a strong development team.

What You'll Do

• Act as the go-to security expert across both embedded/firmware and cloud/API domains, an unusually broad remit by design
• Drive secure-by-design practices across teams building wireless-connected hardware, mobile apps, and cloud services
• Lead threat modeling and security risk assessments for existing and new system architectures, including for products that haven't had formal threat modeling before
• Own the company's approach to CRA and NIS2 compliance: translate regulatory requirements into concrete technical and organizational guidelines, and help formalize documentation that today exists mostly as tribal knowledge
• Assess and guide the use of wireless communication protocols, cryptographic implementations, and secure boot/firmware update practices
• Oversee (not necessarily perform) penetration testing and vulnerability assessments, ensuring findings are understood, prioritized, and remediated
• Introduce and mature security tooling: SAST, SCA, dependency and container scanning, secret detection, SBOM automation, and vulnerability management, tooling choices are not fixed, and this person will help shape them
• Standardize security practices across teams that originated from different companies and currently work in somewhat different ways
• Advise and upskill developers who are sharp and security-conscious, but don't yet have deep security expertise
• Spend the first months assessing current maturity, identifying the biggest gaps, and setting priorities accordingly

What You Bring

• Several years of hands-on experience in product/application security, covering embedded systems, firmware, or IoT, plus cloud/API security
• Solid understanding of wireless communication security, cryptography, and secure firmware/update mechanisms
• Practical experience with CRA, NIS2, or comparable regulatory frameworks, and the ability to turn them into engineering requirements
• Real threat modeling and architecture risk assessment experience
• Familiarity with security tooling: SAST, SCA, dependency/container scanning, secret detection
• A secure-by-design mindset that goes beyond compliance checklists, genuine care about products being secure, not just documented as secure
• Strong communication skills: comfortable working closely with multiple development teams and translating security concepts for technical and non-technical audiences
• Ability to still write code and engage technically with developers, this isn't a pure governance/audit role
• Comfort with ambiguity: tooling, process, and even parts of the role itself are still being defined

What's On Offer

• A genuine greenfield opportunity to shape a security function and culture from scratch
• Remote-friendly setup with flexibility on where the person is based within Germany
• An ambitious team with a start up feel, still actively shaping how they want to work together
• Real influence: this role reports closely to leadership and has genuine air cover to drive change