IoT Product Security & Compliance Engineer

Nabu Casa; Roma; On-site; EUR 71,000 - 92,000; Full time

Benefits offered by this job

Remote work

Five weeks paid time off

Paid sick leave (14 days)

Parental leave (six weeks purchased)

Hardware budget

Smart home budget

Internet stipend (50%)

Personal project day

Open source side projects support

Job summary

Nabu Casa is seeking a Product Security & Compliance Engineer to embed security and regulatory compliance through all product lifecycles. This fully remote, full‑time role spans embedded, cloud, firmware, and hardware domains, focusing on threat modeling, SBOMs, vulnerability management, and conformity evidence.

You will collaborate across hardware, firmware, cloud, and product teams to meet RED, EN 18031, and CRA requirements, delivering formal conformity documentation and risk assessments.

Qualifications

• Strong hands-on technical experience in embedded/firmware, network, application, or cloud security.
• Experience creating architecture or data-flow diagrams and performing threat modeling for real products or systems.
• Practical experience with security testing and tooling such as vulnerability scanning, SAST/DAST, SBOM tooling, and penetration testing.

Responsibilities

• Own the cybersecurity aspects of regulatory compliance for connected hardware products (RED, EN 18031).
• Prepare products and processes for the EU Cyber Resilience Act, including vulnerability handling and incident reporting.
• Create and maintain architecture and data-flow diagrams for connected products and services.
• Perform threat modeling and translate risks into security requirements and controls.
• Conduct hands-on security validation: vulnerability scanning, SAST/DAST, firmware analysis, network exposure, and targeted pen testing.
• Generate and maintain SBOMs and monitor software dependencies for vulnerabilities.
• Validate security mechanisms such as authentication, secure boot, and signed updates.
• Translate assessments into conformity evidence and documentation.
• Collaborate with hardware, firmware, cloud, and product teams early in development.
• Coordinate with ODMs and external certification bodies as needed, while owning internal cybersecurity evidence.
• Work with Open Home Foundation to align security documentation across open-source projects and Nabu Casa products.
• Track conformity status, security support periods, and regulatory deadlines.
• Provide privacy-by-design input for changes to cloud services when needed.

Skills

Embedded security

Network security

Application security

Cloud security

Threat modeling

Architecture diagrams

SAST/DAST tooling

SBOM tooling

Vulnerability scanners

Tools

SBOM tooling

Vulnerability scanners

Firmware analysis tools

Penetration testing tools

Job description

Nabu Casa is seeking a Product Security & Compliance Engineer to embed security and regulatory compliance through all product lifecycles. This fully remote, full‑time role spans embedded, cloud, firmware, and hardware domains, focusing on threat modeling, SBOMs, vulnerability management, and conformity evidence.

You will collaborate across hardware, firmware, cloud, and product teams to meet RED, EN 18031, and CRA requirements, delivering formal conformity documentation and risk assessments.