Industrial Product Security & Penetration Testing Lead

FOSS; Hillerød Kommune; On-site; DKK 673,000 - 972,000; Full time

Job summary

FOSS is seeking a Penetration Tester & Product Security Specialist to build and own our vulnerability management program. You will embed security into hardware and cloud products, reporting to the Head of Information Security and collaborating with R&D.

This full-time on-site role at the Innovation Centre in Hillerød requires hands-on testing across Windows, Linux, embedded targets, and web interfaces, plus governance under the Cyber Resilience Act.

Qualifications

• Demonstrable hands-on penetration testing experience against real systems, including scoping, execution and reporting.
• Embedded or industrial targets experience or clear interest to move into them.
• Strong software engineering skills in C, C++, C#, Python; ability to read production code and discuss findings with developers.
• Working knowledge of IEC 62443-4-1 and 62443-4-2 in a product-manufacturer context.
• Practical vulnerability management: SBOM, software composition analysis, CVE/CVSS, VEX; ability to distinguish exploitable findings from theoretical ones.
• Professional-level English; Danish is an advantage but not required.
• Credibility with engineers; ability to influence through trust rather than authority.
• Structure, follow-through and sound judgement under time pressure; discretion with sensitive information.

Responsibilities

• Plan and carry out hands-on penetration testing across Windows, Linux, embedded targets, web interfaces, APIs, and Azure.
• Own the penetration testing program: decide what gets tested and how often; determine in-house vs external testing.
• Build and run vulnerability management; establish SBOM-based screening and triage for product context.
• Operate the vulnerability handling process per 24-hour reporting and 72-hour notification requirements.
• Support R&D on product risk assessments and STRIDE threat modelling with attacker perspective.
• Advise on secure design and secure development per IEC 62443-4-1/4-2 for industrial environments.
• Contribute technical substance for Cyber Resilience Act conformity: security requirements, evidence, and documentation.

Skills

Penetration testing

C/C++/C#/Python

IEC 62443

SBOM

CVSS/VEX

English proficiency

Influencing engineers

Time management

Security engineering

Job description

FOSS is seeking a Penetration Tester & Product Security Specialist to build and own our vulnerability management program. You will embed security into hardware and cloud products, reporting to the Head of Information Security and collaborating with R&D.

This full-time on-site role at the Innovation Centre in Hillerød requires hands-on testing across Windows, Linux, embedded targets, and web interfaces, plus governance under the Cyber Resilience Act.