Senior Product Security Assessor

Generac Captiva Pvt. Ltd.; Pune District; Vor Ort; INR 1.500.000 - 2.300.000; Vollzeit

Zusammenfassung

Generac Power Systems Inc. is seeking an experienced security professional to perform end-to-end product security assessments for cloud services, backend systems, and IoT devices.

You will evaluate controls across layers, document findings, and provide prioritized remediation aligned with IEC 62443 and internal standards. The role requires threat modeling, secure CI/CD review, and clear communication with engineering teams to reduce risk and strengthen security posture.

Qualifikationen

• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or related field.
• 5+ years in product security, cloud security, DevSecOps, or IoT security roles and IT audit experience.
• Knowledge of embedded systems, firmware security, and IoT security principles.
• Familiarity with IEC 62443, ISO 27001, and NIST 800-53.

Aufgaben

• Conduct end-to-end product security assessments for cloud services, backend systems, DevSecOps pipelines, and IoT devices.
• Evaluate security controls across application, infrastructure, device, and pipeline layers.
• Document assessment scope, findings, compliance status, and overall security posture.
• Perform threat modeling for cloud, device, and DevSecOps domains.
• Assess cloud architectures, containerized workloads, and CI/CD pipelines for secure configurations.

Kenntnisse

Embedded security

Cloud security

DevSecOps

IoT security

Threat modeling

SAST/DAST/SCA

Security audits

IEC 62443

ISO 27001

NIST 800-53

Ausbildung

Bachelor’s degree in CS/Engineering/Cybersecurity

Tools

SAST tools

DAST tools

SCA tools

IaC scanning platforms

Jobbeschreibung

We are Generac, a leading energy technology company committed to powering a smarter world. Over the 60 plus years of Generac’s history, we’ve been dedicated to energy innovation. From creating the home standby generator market category, to our current evolution into an energy technology solutions company, we continue to push new boundaries.

Major Responsibilities

• Conduct end-to-end product security assessments for cloud services, backend systems, DevSecOps pipelines, and IoT devices against defined security requirements.
• Evaluate security controls across application, infrastructure, device, and pipeline layers to identify gaps, weaknesses, and non-conformances.
• Perform assessments aligned to IEC 62443 and internal Generac product security standards.
• Clearly document assessment scope, findings, compliance status, and overall security posture.
• Perform structured threat modeling for identified findings and architectural designs across cloud, device, and DevSecOps domains.
• Assess risk severity and potential impact, considering exploitability, exposure, and business context.
• Translate technical findings into clear risk statements that engineering and product teams can act upon.
• Assess backend cloud architectures, including containerized workloads and orchestrated environments, for secure configuration, network segmentation, identity controls, and data protection.
• Review container security practices such as image scanning, runtime protections, and least-privilege configurations.
• Evaluate cloud logging, monitoring, and incident detection capabilities to ensure adequate security observability.
• Assess CI and CD pipelines to ensure security controls are integrated and consistently applied.
• Review use of SAST, DAST, SCA, and infrastructure-as-code scanning within development workflows.
• Evaluate secrets management, key handling, and signing processes used in build and release pipelines.
• Identify gaps in automation, enforcement, or visibility that could introduce security risk.
• Conduct IoT device security assessments covering hardware, firmware, and embedded software.
• Evaluate secure boot, firmware signing, credential storage, encryption, and update mechanisms.
• Assess protections against physical tampering, reverse engineering, and unauthorized firmware modification.
• Review device compliance against IEC 62443-based device security requirements.
• Produce clear, structured assessment reports that document findings, risk ratings, and compliance gaps.
• Provide prioritized, risk-informed remediation recommendations that are practical and actionable.
• Support engineering teams by clarifying findings, answering technical questions, and validating remediation evidence.
• Execute assessments in alignment with defined Product Security engagement models and timelines.
• Participate in regular checkpoints, status updates, and structured feedback sessions Ensure consistency and quality across assessments through standardized templates and methodologies.

Minimum Job Requirements

Education

Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related technical field. Equivalent practical experience is also valued.

Work Experience

5+ years of experience in product security, cloud security, DevSecOps, or IoT security roles. 5+ years of IT audit experience.

Knowledge / Skills / Abilities

• Working knowledge of embedded systems, firmware security, and IoT security principles.
• Mastery of security standards and frameworks such as IEC 62443, ISO 27001, and NIST 800-53.
• Ability to produce clear, concise, and high-quality security assessment documentation.
• Clear communicator who can work across engineering, product, and security stakeholders.
• The ability to manage up to 10 concurrent, complex audits.
• Hands‑on experience performing threat modeling, vulnerability assessments, and security reviews.
• Strong understanding of backend cloud architectures, container platforms, and CI and CD pipelines.

Preferred Job Requirements

Education

Bachelor’s or Master’s degree in Computer Science, Engineering, Cybersecurity, Information Security, or a related technical discipline.

Certification / License

Certifications such as CISSP, CCSP, CSSLP, or cloud security certifications are helpful but not required.

Work Experience

• Experience with IEC 62443 compliance assessments or similar industrial cybersecurity standards in production environments.
• Experience conducting security assessments of IoT or embedded devices, including firmware analysis and hardware security evaluation.
• Familiarity with DevSecOps tooling such as SAST, DAST, SCA, and infrastructure-as-code scanning platforms.
• Experience with cloud security posture management in AWS, Azure, or GCP environments.

Knowledge / Skills / Abilities

Ability to balance thoroughness of assessment with speed of delivery, and to convert complex technical findings into practical, actionable remediation guidance for engineering teams.

Physical Requirements and Working Conditions

PHYSICAL DEMANDS:

Office Environment: While performing the duties of this job, the employee is regularly required to talk and hear and use hands to operate a computer and standard office equipment. The employee is regularly required to sit, stand, and walk. Specific conditions of this job are typical of frequent and continuous computer based work requiring periods of sitting, close vision, and the ability to adjust focus. Occasional travel may be required. This role is primarily office based and does not generally require shop floor or field technician physical demands.

DISCLAIMER All responsibilities and requirements are subject to possible modification to reasonably accommodate individuals with disabilities. This job description does not state or imply that these are the only responsibilities to be performed by an employee in this role. Employees must follow any other job related instructions and perform any other job related duties requested by their leaders.

We believe power is a promise - a shared commitment to be there for others when it matters most. For more than 65 years, we've turned big ideas into solutions that help protect homes, strengthen businesses and build a more resilient, efficient, sustainable energy future. Ready to Power a Smarter World with us? As one of the leaders and largest suppliers of power generation equipment and technology, the work we do touches millions of lives. Employees at Generac are encouraged to be innovative and are valued as an integral part of our global team. Our challenging goals develop knowledgeable employees dedicated to helping continue Generac’s success. Generac provides individuals the opportunity to work in a fast-paced agile work environment where their work makes a difference in people’s lives and their own.