Product Security Engineer

OMEGA, Inc.; Chennai District; On-site; INR 11,461,000 - 17,192,000; Full time

Job summary

HBK Hottinger Brüel & Kjaer (HBK) seeks a Product Security Engineer with a strong software development and security testing background to embed security across the product lifecycle. You will work with Product Engineering, QA, DevOps, and Product Security teams to identify, assess, and remediate security risks, implementing effective security controls and automated test coverage.

The role requires experience with SAST/DAST, threat modelling, SBOM maintenance, and secure coding practices within

Qualifications

• 5+ years in software development, application security, or product security.
• Strong hands-on experience in at least one programming language (C/C++, Java, Python, or JavaScript).
• Knowledge of SDLC and testing methodologies.
• Experience with security testing tools (SAST, SCA, DAST, fuzzing, pentesting).
• Understanding of OWASP Top 10, CWE/CVE, crypto weaknesses, and secure configurations.

Responsibilities

• Integrate security into SDLC from design through release.
• Perform security reviews of architecture, source code, APIs, and components.
• Conduct security tests including SAST/DAST, fuzz, and pentesting.
• Triage and remediate security vulnerabilities with developers.
• Develop security test cases and automation for coverage.
• Support secure coding practices in CI/CD pipelines.
• Engage in threat modelling and risk assessments for features.
• Review third-party components and support SBOM maintenance.
• Maintain security evidence for regulatory compliance.

Skills

Security engineering

Software development

SDLC knowledge

Security testing

Threat modelling

SBOM / SPDX/CycloneDX

CI/CD / DevSecOps

Vulnerability analysis

Language proficiency (C/C++, Java, JS,

Education

Bachelor’s or Master’s in Cyber Security/CS/Software Engineering

Tools

Burp Suite

OWASP ZAP

Coverity

SonarQube

Black Duck

JFrog / GitHub Advanced Security

Job description

Role Overview We are looking for a Product Security Engineer with a strong background in software development, software testing, and security engineering to embed security into the product development lifecycle. The role will work closely with Product Engineering, QA, DevOps, and Product Security teams to identify, assess, and remediate security risks across products. The ideal candidate should be able to understand code, design and execute security tests, identify vulnerabilities, and work directly with development teams to implement effective security controls.

Key Responsibilities

• Integrate security practices into the Software Development Life Cycle (SDLC) from design through release.
• Perform security reviews of product architecture, source code, APIs, and software components.
• Conduct security testing including: SAST and SCA DAST/API security testing Vulnerability assessment Fuzz testing Penetration testing Security regression testing
• Review and analyze vulnerabilities identified through security tools and testing activities.
• Work with developers to triage, reproduce, prioritize, and remediate security vulnerabilities.
• Develop security test cases and automation to improve security testing coverage.
• Support implementation of secure coding practices and security controls within CI/CD pipelines.
• Participate in threat modelling and security risk assessments for new features and products.
• Review third-party and open-source components for security risks and support SBOM generation and maintenance.
• Support vulnerability remediation and security update processes throughout the product lifecycle.
• Investigate security defects and perform root-cause analysis to prevent recurrence.
• Support security requirements, security acceptance criteria, and release security assessments.
• Collaborate with Product Security Architect, Product Security Specialist ,Developers, QA, DevOps, and Product Managers to drive security improvements.
• Maintain evidence and documentation required for product security and regulatory compliance, including EU Cyber Resilience Act (CRA) requirements.

Qualifications

Education Bachelor’s or master’s degree in cyber security, Computer Science, Information Security, Software Engineering, or a related technical discipline.

Required Experience and Skills

• 5+ years of experience in software development, application security, or product security.
• Strong hands‑on experience in at least one programming language such as C/C++, Java, Python, or JavaScript.
• Good understanding of software development lifecycle and testing methodologies.
• Strong debugging, analytical, and problem-solving skills.
• Ability to read and understand source code and work closely with developers on remediation.
• Experience with security testing tools such as SAST, SCA, DAST, vulnerability scanners, fuzzing tools, and penetration‑testing tools.
• Understanding of common application and product security vulnerabilities such as OWASP Top 10, CWE, injection, authentication/authorization issues, memory vulnerabilities, insecure configurations, and cryptographic weaknesses.
• Experience with Git, CI/CD pipelines, and Dev SecOps practices.
• Understanding of threat modelling, risk assessment, vulnerability management, and secure coding principles.
• Experience analyzing vulnerabilities using CVSS/CWE/CVE information.
• Good understanding of software composition analysis and open‑source security.
• Good to Have Experience with embedded products, firmware, hardware‑software products, or network/security products.
• Knowledge of SBOM formats such as SPDX or CycloneDX.
• Experience with tools such as Black Duck, JFrog, GitHub Advanced Security, Coverity, SonarQube, Burp Suite, OWASP ZAP, or similar tools.
• Knowledge of cryptography, TLS, PKI, secure boot, code signing, and key management.
• Experience implementing security controls in CI/CD pipelines.

Key Deliverables / Success Measures

• Security vulnerabilities identified early in the development lifecycle.
• Security testing integrated into CI/CD and product release processes.
• Timely remediation of product security vulnerabilities.
• Improved security test coverage and automation.
• Security requirements and threat-model findings addressed before product release.
• Accurate SBOM and vulnerability information maintained for products.
• Product security evidence available to support regulatory compliance requirements.

One Company – HBK Hottinger Brüel & Kjaer (HBK)

HBK Hottinger Brüel & Kjaer (HBK) is a global leader in the fields of sensors, data acquisition, analytics and collaboration for various R&D, production and in-operation applications. Until the end of July 2020, the companies were known as Hottinger Baldwin Messtechnik GmbH (HBM) and Brüel & Kjær Sound & Vibration Measurement A/S respectively. HBK is part of Spectris Limited and employs around 3500 people worldwide. Our product eco system covers all layers from sensors, electronics, to software and collaboration. Our customers range from end users of the entire tool chain focusing on analytics and results in virtual testing, physical testing, and monitoring, to our OEM and system integrator partners and customers integrating our products into their own offering and solution. The product portfolio is as versatile and varied as our customer base covering many industries. We have engineering and production facilities in Germany, Denmark, UK, Portugal, USA and China and are represented in over 80 countries worldwide. We are proud to be one of the top three suppliers worldwide in our market segments served, thanks to our high-quality products and the commitment of our employees.