Product Security & Compliance Engineer

Jobgether Srl; Lisboa; A distancia; EUR 82.000 - 103.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Five weeks vacation

Paid sick leave

Parental leave

Remote-friendly

Hardware budget

Smart-home budget

Internet stipend

Personal projects day

Descripción de la vacante

Jobgether Srl procura um(a) Product Security & Compliance Engineer para liderar a segurança e a conformidade de produtos conectados, atuando em hardware, firmware e serviços em cloud. O cargo exige experiência prática em segurança de sistemas embarcados, redes e plataformas cloud, com foco em threat modeling e avaliação de risco.

O candidato ideal terá forte capacidade de documentação de evidências, SBOMs e conformidade regulatória, além de fluência em inglês, operação remota e colaboração com

Formación

• Experiência prática em pelo menos um domínio de segurança (embedded/firmware, rede, aplicação ou nuvem).
• Capacidade de criar diagramas de arquitetura/fluxo de dados e realizar threat modeling.
• Experiência com ferramentas de teste de segurança: varredura de vulnerabilidades, SAST/DAST, SBOM tooling.
• Experiência com produtos conectados, IoT, firmware e ambientes hardware/nuvem.
• Capacidade de traduzir achados de segurança em documentação, evidências e avaliações de risco.
• Conhecimento de padrões/regulamentos como EN 18031, RED, EU Cyber Resilience Act, ETSI EN 303 645, IEC 62443.
• Boa comunicação verbal e escrita em inglês.
• Certificações como OSCP, GIAC, CISSP, CIPP/E ou CIPT são desejáveis.

Responsabilidades

• Gerir os aspectos de cibersegurança da conformidade regulatória para hardware conectado.
• Preparar evidências para avaliação de conformidade e Declarations of Conformity.
• Desenhar diagramas de arquitetura/fluxo de dados e mapear riscos para controles.
• Conduzir threat modeling e converter riscos em requisitos de segurança.
• Executar validações de segurança, incluindo SAST/DAST, SBOM e pentests.
• Gerar SBOMs e acompanhar vulnerabilidades em dependências de software.
• Colaborar com equipes de hardware, firmware, cloud e produto para incorporar segurança no lifecycle.
• Manter evidências de cibersegurança junto a fabricantes e organismos de certificação.

Conocimientos

Threat modeling

Security architecture

Security testing

Privacy-by-design

English fluency

Vulnerability management

Educación

OSCP

CISSP

GIAC

CIPP/E

CIPT

Herramientas

SBOM tooling

SAST/DAST

Firmware analysis tools

Network security tools

IoT security tooling

Descripción del empleo

Product Security & Compliance Engineer

Salary: €81,800 - 102,700 yearly

Descrição do Emprego - Product Security & Compliance Engineer This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Product Security & Compliance Engineer based in Portugal.

This role combines hands-on product security engineering with cybersecurity compliance across connected hardware and cloud services. You will help build secure, resilient products while ensuring they meet evolving regulatory and cybersecurity requirements. Your work will span embedded devices, firmware, networking, software dependencies, and cloud services. You'll conduct threat modeling, security validation, vulnerability assessments, and supply-chain risk management while translating findings into practical controls.

The role also involves preparing technical evidence and documentation for product conformity and regulatory assessments. You'll collaborate closely with hardware, firmware, cloud, product, external manufacturing, and certification teams in a distributed environment. It is an opportunity to take meaningful ownership at the intersection of product security, compliance, connected technology, and privacy.

Accountabilities

• Own cybersecurity aspects of regulatory compliance for connected hardware products, including RED cybersecurity requirements and EN 18031.
• Support preparation for the EU Cyber Resilience Act, covering vulnerability management, security updates, Software Bills of Materials, support periods, and incident reporting.
• Create and maintain architecture and data-flow diagrams for connected products and associated services.
• Conduct threat modeling and translate identified risks into actionable security requirements, controls, and engineering priorities.
• Perform hands-on product security validation, including vulnerability and dependency scanning, SAST/DAST, software composition analysis, firmware analysis, network and service exposure assessments, and targeted penetration testing.
• Generate, maintain, and monitor SBOMs to identify and manage vulnerabilities within software dependencies.
• Validate security mechanisms including authentication, secure boot, and signed software or firmware updates.
• Translate security assessments and testing results into compliance evidence, technical documentation, risk assessments, conformity assessments, and Declarations of Conformity.
• Partner with hardware, firmware, cloud, and product engineering teams to embed security and compliance requirements early in the development lifecycle.
• Coordinate with external manufacturing partners and certification bodies while maintaining internal ownership of cybersecurity evidence.
• Collaborate with open-source communities and related projects to ensure security information, vulnerability handling, and software documentation are effectively maintained.
• Track product conformity status, security support periods, regulatory deadlines, and changes that may require reassessment.
• Provide privacy-by-design guidance for significant changes to cloud and software services when required.

Requirements

• Strong hands-on technical experience in at least one security domain, such as embedded/firmware security, network security, application security, or cloud security.
• Experience creating architecture or data-flow diagrams and conducting threat modeling for real-world products or systems.
• Practical experience with security testing and tools, including vulnerability scanning, SAST/DAST, software composition analysis, SBOM tooling, network security testing, firmware analysis, or penetration testing.
• Experience working with connected products, IoT, embedded systems, firmware, or environments combining hardware, software, and cloud services.
• Demonstrated ability to translate technical security findings into structured documentation, evidence, risk assessments, and compliance requirements.
• Knowledge of product cybersecurity standards and regulations such as EN 18031, RED cybersecurity requirements, the EU Cyber Resilience Act, ETSI EN 303 645, IEC 62443, or comparable frameworks.
• Ability to independently interpret technical requirements, identify security and compliance gaps, and work with engineering teams to implement appropriate solutions.
• Strong understanding of security principles, vulnerability management, software supply-chain risks, and secure product development practices.
• Comfortable working autonomously across multiple technical domains within a distributed organization.
• Strong written and verbal communication skills, with the ability to explain technical security topics to both engineering and non-technical stakeholders.
• Fluent written and spoken English.
• Experience with secure boot, signed OTA updates, firmware security, or constrained embedded devices is highly desirable.
• Familiarity with GDPR, privacy-by-design, ISO/IEC 27001, OWASP ASVS/MASVS, NIST SSDF, or related security and privacy frameworks is advantageous.
• Relevant certifications such as OSCP, GIAC, CISSP, CIPP/E, or CIPT are a plus.

Full‑time employment with a competitive compensation package benchmarked around the 75th percentile for the role, seniority, and local market.

UK compensation range of £81,800‑£102,700, subject to experience, qualifications, and working hours.

Five weeks (25 days) of paid time off.

Fourteen days of paid sick leave where required to supplement local statutory provisions.

Six weeks of paid and six weeks of unpaid parental leave during the first year after birth, with additional compensation where local provisions are insufficient.

Budget for work hardware, with equipment eligible to be retained for personal use after three years.

Annual smart‑home budget to support access to current smart‑home technology.

50% contribution toward the internet connection used for your home workspace.

One workday every two weeks dedicated to personal projects.

Opportunity to maintain relevant Home Assistant‑related side projects during work time.

Fully remote working environment with no fixed schedule and approximately three hours of daily team overlap for collaboration.

Benefits aligned with the requirements of the employee's country of residence, alongside a baseline package designed to provide consistent support internationally.

Opportunity to work on privacy‑focused, open‑source, connected technology with global reach.

Collaborative, distributed environment centered on autonomy, ownership, privacy, choice, and sustainability.

Product Security & Compliance Engineer • Lisbon, Portuguese Republic, PT