IoT Security Analyst (m/f/d)

DEKRA Digital & Product Solutions; Málaga; Hybride; EUR 42 000 - 60 000; Plein temps

Avantages offerts par ce poste

Health insurance fully paid by the公司

Hybrid working options around Málaga

Meal, childcare, transport and Wellhub

Training and certification programs

English lessons

Employee referral incentives

Snacks and coffee in the office

Résumé du poste

DEKRA Digital & Product Solutions in Málaga is seeking security engineers to evaluate IoT devices end‑to‑end, focusing on hardware, firmware, web and mobile security across ecosystems.

The role involves vulnerability analysis, cryptographic and protocol assessments, and collaboration with global customers to improve safety and compliance. Knowledge of OWASP standards and tools like Burp Suite is valued, with opportunities for growth in cybersecurity events and certifications.

Qualifications

• Bachelor’s degree in Telecommunications, Electronics, Computer Engineering, Computer Science, Cybersecurity, or a closely related field.
• 1–2 years of hands‑on experience in cybersecurity, ideally in IoT or embedded security.
• Practical knowledge of IoT and embedded systems (microcontrollers, embedded Linux, firmware) and common IoT protocols such as BLE, Wi‑Fi or MQTT.
• Basic hardware security skills: using debug interfaces (UART, JTAG/SWD) and firmware extraction/analysis (binwalk, unblob).
• Basic knowledge of web and mobile app security (OWASP Top 10, OWASP MASVS) and tools such as Burp Suite.
• Working knowledge of Linux and scripting (Python, Bash or similar).
• Excellent analytical, organizational, and problem‑solving skills.
• Strong written and verbal communication skills in English.
• Demonstrated ability to collaborate effectively in international and multidisciplinary teams.

Responsabilités

• Perform security evaluations of IoT devices and their full ecosystem (device, companion app and cloud backend) against standards such as EN 18031, ETSI EN 303 645 and OWASP ISVS.
• Analyze hardware and firmware: identify debug interfaces (UART, JTAG/SWD), extract firmware from flash memory or update packages, and review embedded Linux systems for weaknesses.
• Assess wireless and IoT communication protocols such as BLE, Wi‑Fi, Zigbee and MQTT.
• Perform penetration tests of web applications and APIs, including device web interfaces and cloud backends, following OWASP WSTG and OWASP ASVS.
• Perform security assessments of Android and iOS applications, including IoT companion apps, following OWASP MASVS/MASTG.
• Support product security certification and compliance projects under the guidance of senior team members.
• Prepare clear technical reports documenting vulnerabilities, risk ratings and mitigations, and communicate findings to international customers.
• Stay current with emerging attack techniques, tools and security practices across IoT, web and mobile.

Connaissances

Analytical thinking

English communication

Team collaboration

Problem solving

Formation

Bachelor’s degree in Telecommunications/Electronics/CS/Cybersecurity

Outils

Burp Suite

binwalk

Ghidra

Frida

Objection

MobSF

JADX

Description du poste

Sinnce its foundation in 1925, the DEKRA promise has been to ensure the safety of human interaction with technology and the environment. Today, DEKRA employs around 48,000 people across more than 60 countries on all five continents.

Following our 100th anniversary in 2025, our vision remains clear and ambitious: to be the global partner for a safe, secure, and sustainable world.

Within our Cybersecurity Hub, we evaluate the security of connected products end to end, with a strong focus on IoT and embedded devices and their full ecosystem: hardware, firmware, wireless protocols, companion mobile apps, web interfaces and cloud backends. We collaborate with world-leading manufacturers and technology companies to identify risks and vulnerabilities and verify compliance with international security standards and certification schemes.

You will join a globally recognized security lab within a multidisciplinary team covering IoT/hardware, web and mobile security, working on international projects for top-tier customers. We are looking for professionals passionate about IoT and embedded security who also want to grow in web and mobile penetration testing, combining analytical thinking and creativity to help safeguard our digital world.

What will your responsibilities be?

• Perform security evaluations of IoT devices and their full ecosystem (device, companion app and cloud backend) against standards such as EN 18031, ETSI EN 303 645 and OWASP ISVS.
• Analyze hardware and firmware: identify debug interfaces (UART, JTAG/SWD), extract firmware from flash memory or update packages, and review embedded Linux systems for weaknesses.
• Assess wireless and IoT communication protocols such as BLE, Wi‑Fi, Zigbee and MQTT.
• Perform penetration tests of web applications and APIs, including device web interfaces and cloud backends, following OWASP WSTG and OWASP ASVS.
• Perform security assessments of Android and iOS applications, including IoT companion apps, following OWASP MASVS/MASTG.
• Support product security certification and compliance projects (e.g., EU Cyber Resilience Act, ETSI/EN standards, ioXt, MASA, CASA) under the guidance of senior team members.
• Prepare clear technical reports documenting vulnerabilities, risk ratings and recommended mitigations, and communicate findings to international customers.
• Stay current with emerging attack techniques, tools and security practices across IoT, web and mobile.

What do we expect from you?

• Bachelor’s degree in Telecommunications, Electronics, Computer Engineering, Computer Science, Cybersecurity, or a closely related field.
• 1–2 years of hands‑on experience in cybersecurity, ideally in IoT or embedded security (professional experience, internships, research or personal projects).
• Practical knowledge of IoT and embedded systems (microcontrollers, embedded Linux, firmware) and common IoT communication protocols such as BLE, Wi‑Fi or MQTT.
• Basic hardware security skills: identifying and using debug interfaces (UART, JTAG/SWD) and extracting and analyzing firmware (e.g., binwalk, unblob).
• Basic knowledge of web and mobile application security (OWASP Top 10, OWASP MASVS) and tools such as Burp Suite.
• Working knowledge of Linux and scripting (Python, Bash or similar).
• Excellent analytical, organizational, and problem‑solving skills.
• Strong written and verbal communication skills in English.
• Demonstrated ability to collaborate effectively in international and multidisciplinary teams.

Ideally, you’ll also have:

• Familiarity with IoT security frameworks and standards such as OWASP IoT Top 10, ETSI EN 303 645 or EN 18031.
• Experience with hardware hacking tools (logic analyzer, flash programmers, SDR), reverse engineering of embedded binaries (e.g., Ghidra), RTOS or IoT ecosystems such as Zigbee, Thread or Matter.
• Hands‑on experience in web application and API penetration testing.
• Experience with mobile app testing tools (Frida, Objection, MobSF, jadx) and rooted/jailbroken devices.
• Knowledge of the EU Cyber Resilience Act and product security certification schemes.
• Cybersecurity certifications (e.g., OSCP, eJPT, CWES, BSCP, eMAPT, or IoT/hardware‑specific ones), which are valuable but not mandatory.
• Participation in security communities, CTFs, bug bounty programs or open-source projects (e.g., GitHub, Hackaday).
• Additional language skills (German, Spanish, Chinese) would be beneficial

What do we offer?

• A permanent contract with hybrid working options based around our Málaga (Parque Tecnológico) office.
• Flexible working arrangements, with early finishes on Fridays and during the summer.
• Health insurance fully paid by the company.
• Access to meal, childcare, transport and Wellhub benefit options.
• Professional development through internal and external training, certification programs and opportunities to participate in cybersecurity events.
• English lessons to support your continued development.
• Projects with leading technology companies and collaboration with experienced cybersecurity specialists.
• Employee referral incentives, the KUDOS recognition program and discounts across major brands.
• Healthy snacks and free coffee in the office.

At DEKRA we value your unique experiences, perspectives, and backgrounds. We are committed to an inclusive workplace for all team members