Cyber Security Lead for Devices

Zaptec; Stavanger; Hybrid; NOK 900,000 - 1,100,000; Full time

Benefits offered by this job

Hardware provided

Zaptec gear

Insurance & pensions

Job summary

Zaptec in Stavanger is seeking a senior security engineer for embedded devices to shape how security is built into our connected chargers. You will own risk assessments, vulnerability management and compliance evidence across products, working with hardware, firmware and software teams.

You’ll run threat modelling, review architectures, and guide teams on secure boot, cryptography and update protection, helping demonstrate our devices are secure before reaching customers. English required.

Qualifications

• Experience with cyber security for connected devices, embedded systems, or related area.
• Understanding of threat modelling, security requirements and secure-development practices.
• Hands-on experience with device-security areas such as secure boot, cryptography, secure storage and update protection.
• Embedded-technology understanding with firmware and hardware teams (e.g., embedded Linux, RTOS, networking).
• Professional working proficiency in English, both written and spoken.

Responsibilities

• Run threat-modelling and security-requirement sessions early in product development.
• Review device architectures and guide teams on practical security improvements.
• Strengthen areas like secure boot, device identities, cryptography and update verification.
• Define risk assessments, vulnerability-management processes and security evidence.
• Coordinate security testing and build confidence before customer release.

Skills

Threat modelling

Security architecture

Cryptography

Device security

Embedded Linux

C/C++

Education

Degree in cyber security or related field

Job description

More than 750,000 of our chargers are installed across Europe. They are physical, internet-connected products that receive automatic over-the-air updates. That means the security decisions we make affect products already running in customers' homes and businesses.

As our products and the expectations around connected-device security continue to grow, we're looking to strengthen how security is built into the products we develop and maintain.

This is a senior individual-contributor role within our Embedded Software department, where you'll work closely with the teams building our connected devices and the software that runs on them. You'll shape technical decisions, strengthen our security development practices and help turn security risks and requirements into practical engineering decisions.

You’ll also take ownership of the structure and evidence behind our device security, from risk assessments and vulnerability management to compliance documentation. You won't be solely responsible for device security, security is something we build together, but you will be the person staying closest to the area, identifying what needs attention and making sure the right people have the insight they need to act.

Stavanger is our preferred location, but we're open to discussing remote arrangements with experienced candidates. We'll find a way of working that makes sense together.

You’ll spend time on things like:

• Run threat-modelling and security-requirement sessions to identify meaningful risks early in product development.
• Review device architecture, designs and security-sensitive implementations, and guide teams towards practical improvements.
• Strengthen areas such as secure boot, device identities, cryptography, secure storage, firmware signing, update verification and rollback protection.
• Define and maintain risk assessments, vulnerability-management processes, compliance documentation and the security evidence needed across our products.
• Guide teams through security trade-offs and help translate risks and requirements into practical engineering decisions.
• Coordinate security testing and help build confidence in our products before they reach customers.
• Collaborate across cyber security, cloud and the wider organisation while staying close to the embedded developers building our devices.

A key part of your role will be helping Zaptec answer not only “are we compliant?”, but “are our devices secure, and can we demonstrate it?” You’ll create the structure, technical understanding and visibility that help the right people make informed security decisions.

Is this you?

You have experience with cyber security for connected devices, embedded systems, industrial products, or a closely related area. You understand that securing a device means working with hardware, firmware, software, identities, update paths, and the people who build and operate them.

You are comfortable moving between technical engineering and structured security work. You can review a design, ask difficult questions, identify what matters and help a team turn the answer into practical work.

Your experience may come from connected devices, industrial systems, automotive, energy, telecommunications, or another environment where security has to work in a real product.

You do not need to be an expert in every area below. We expect substantial experience in several of them, and you'll have the opportunity to develop across the rest.

Some personal skills we value

• Structured and thorough, with the follow-through needed to turn findings into action.
• Pragmatic, with an ability to make security work in the context of real products and delivery constraints.
• A clear and confident communicator in technical discussions and written work.
• Curious and comfortable going deep into unfamiliar technical problems.
• Able to build trust and influence decisions across teams without relying on formal authority.

As for the skills required for this job

• Experience with cyber security for connected devices, embedded systems, industrial products, or a closely related area.
• Understanding of threat modelling, security requirements and secure-development practices.
• Hands-on experience with several device-security areas, such as secure boot and chain of trust, cryptography and key management, secure storage and hardware roots of trust, device identity and credentials, signed firmware updates and rollback protection, embedded networking and protocol security, vulnerability management, or security testing.
• Enough embedded-technology understanding to work credibly with firmware and hardware teams. This may include embedded Linux, C/C++, RTOS, networking, or hardware-adjacent software.
• A degree in cyber security, information security, computer science, computer engineering, embedded systems, or a related field, or equivalent practical experience.
• Professional working proficiency in English, both written and spoken.

It would be a bonus if you have

• Experience with the Cyber Resilience Act, EN 18031, IEC 62443, or similar product-security standards.
• Experience with hardware security modules, secure elements, TPMs, or other hardware roots of trust.
• Experience with security testing, penetration testing, vulnerability research, or security assessments.
• Experience with EV charging, energy, or other regulated connected products.

If you have a strong foundation in device security and enjoy working through difficult engineering problems with the teams building the product, we’d like to talk. You don’t need to tick every box to be a great fit for this role.

• We trust you do your job, flex your own day
• We'll provide the hardware you need
• Pick your favourite Zaptec gear - it's on us.
• We got your back in regards to insurance and pensions