Product Security- Embedded IoT

Arrow Electronics; Ahmedabad District; In loco; INR 1.500.000 - 2.500.000; Tempo pieno

Descrizione del lavoro

Arrow Electronics, via its eInfochips unit in Ahmedabad, seeks a Product Security Engineer for Embedded / IoT. You will assess and secure embedded systems, conduct VAPT, model threats, review controls, and support SSDLC across hardware, firmware and software teams.

The role demands hands-on testing of interfaces (UART/JTAG/SPI/I2C/USB), firmware analysis, secure boot and OTA concepts, with C/C++ and scripting skills. 2–10 years of experience preferred.

Competenze

• 2–10 years of experience in product security for embedded/IoT.
• Hands-on security testing of embedded hardware, firmware and interfaces.
• Experience with VAPT, threat modeling and secure design reviews.
• Ability to analyze firmware, perform reverse engineering, and validate remediations.

Mansioni

• Review hardware/firmware designs to identify assets, attack surfaces and risks.
• Plan and execute hardware and firmware VAPT using varied approaches.
• Perform firmware analysis, reverse engineering and code reviews as applicable.
• Develop threat models, security requirements and test plans throughout the lifecycle.
• Validate security controls and collaborate with engineering to verify fixes.

Conoscenze

Embedded security

VAPT

Threat modeling

Firmware analysis

Python scripting

C/C++ code

Ghidra/IDA

Wireshark

SBOM analysis

Strumenti

Ghidra

IDA

Binwalk

GDB

OpenOCD

Wireshark

Nmap

Descrizione del lavoro

Job Description:

Position: Product Security- Embedded / IoT

Job Description:

Job Description: Product Security Engineer, Embedded / IoT

Experience: 2 to 10 years
Role Overview

We are looking for product security professionals with hands‑on experience in assessing and securing embedded systems and IoT products.

The role involves performing product security assessments, conducting VAPT, developing threat models and security requirements, reviewing security controls, and supporting SSDLC activities. The selected candidate will work closely with hardware, firmware, software, and product engineering teams to identify vulnerabilities, recommend practical mitigations, and validate remediation.

Key Skills

• Understanding of embedded product architecture, microcontrollers, processors, bootloaders, memory, storage, and embedded Linux and/or RTOS environments. Ability to interpret hardware block diagrams, relevant schematic sections, and firmware architecture.

• Hands‑on experience assessing debug, programming, or communication interfaces such as UART, JTAG/SWD, SPI, I²C, and USB. Familiarity with device debugging, flash access, firmware acquisition, and evaluation of debug and readout protections.

• Experience with firmware extraction or acquisition, unpacking, filesystem analysis, configuration review, and static and/or dynamic analysis. Ability to identify hardcoded credentials, exposed secrets, insecure services, weak permissions, vulnerable components, and weaknesses in firmware update mechanisms.

• Experience conducting manual and tool‑assisted security testing of physical devices, firmware, and exposed interfaces. Ability to validate vulnerabilities, distinguish false positives, demonstrate impact safely, and recommend relevant remediation.

• Working knowledge of threat modeling, attack‑surface analysis, security risk assessment, product security requirements, secure design review, and security validation. Understanding of assets, data flows, trust boundaries, attack scenarios, and requirement‑to‑test traceability.

• Understanding of secure boot, firmware signing, secure OTA updates, rollback protection, authentication, authorization, cryptographic key storage, certificate management, secure communications, and production security configuration.

• Knowledge of TCP/IP and relevant embedded or IoT interfaces and protocols, such as Ethernet, Wi‑Fi, BLE, CAN, MQTT, HTTP(S), and TLS. Experience capturing and analyzing traffic and assessing communication security.

• Ability to understand C/C++ code and develop or modify Python or shell scripts.

• Experience with relevant tools such as Ghidra or IDA, Binwalk, GDB, OpenOCD, Wireshark, Nmap, flash programmers, debug probes, and logic analyzers.

• Familiarity with SAST, SCA, and Software Bill of Materials (SBOM) analysis.

Job Responsibilities

• Review product architecture, hardware and firmware designs, interfaces, deployment environments, and use cases to identify assets, attack surfaces, trust boundaries, and security risks.

• Plan and execute hardware and firmware VAPT using black‑box, grey‑box, or white‑box approaches, as applicable. Assess physical access, debug interfaces, firmware, operating‑system configuration, services, communication interfaces, and device management interfaces.

• Perform firmware analysis, binary analysis, reverse engineering, and security‑focused source code reviews where applicable. Investigate vulnerabilities and document reproducible evidence, root causes, and product impact.

• Develop and maintain threat models, security risk assessments, product security requirements, security test plans, test cases, and traceability records throughout the product lifecycle.

• Review and validate security controls, including secure boot, signed firmware updates, rollback protection, credential handling, access control, secure communications, and debug restrictions.

• Execute or review SAST, SCA, and firmware/binary scanning results. Analyze SBOMs, assess vulnerability applicability, eliminate false positives, and prioritize findings based on exploitability, exposure, and product impact.

• Prepare technical reports with findings, evidence, risk ratings, and actionable remediation recommendations. Collaborate with engineering teams, verify fixes, and document residual risks.

• Develop reusable testing scripts, procedures, and checklists. Support security activities within development and release workflows and assess newly disclosed vulnerabilities affecting supported products.

Location: IN-GJ-Ahmedabad, India-Ognaj (eInfochips)

Time Type: Full time

Job Category: Engineering Services

Requirements: