Embedded IoT Security Penetration Specialist

Spyro Soft; United States; Remote; USD 110,000 - 170,000; Full time

Job summary

Spyro Soft is looking for a Penetration Tester with deep expertise in embedded systems and IoT security to identify and exploit weaknesses across diverse environments. The role demands strong analytical skills and the ability to translate findings into actionable guidance for stakeholders.

You will design secure architectures for embedded and cloud-connected devices, conduct threat modeling, perform penetration and fuzz testing on interfaces like JTAG, UART, SPI and I²C, and help integrate

Qualifications

• Proven experience in embedded systems, IoT security, or product cybersecurity.
• Hands-on knowledge of secure boot, firmware protection, code signing, and secure update mechanisms.
• Good understanding of cryptography and key management in embedded environments.
• Experience securing communication protocols and network interfaces in connected devices.
• Knowledge of IoT authentication, authorization, and cloud security architectures.
• Experience with threat modeling methodologies such as STRIDE, DREAD, and Attack Trees.
• Ability to perform security risk assessments aligned with: ISO 21434, IEC 62443, ISO 27005.
• Understanding of common embedded attack vectors: side-channel attacks, fault injection, firmware tampering, replay attacks, MITM attacks.
• Experience conducting penetration testing on embedded targets using interfaces such as JTAG, UART, SPI, and I²C.
• Experience with fuzz testing communication stacks (CAN, TCP/IP, MQTT).
• Understanding of secure SDLC principles, DevSecOps, and cybersecurity lifecycle management.
• Knowledge of vulnerability management, system hardening, and threat surface reduction strategies.
• Understanding of GDPR, HIPAA, and data protection requirements for cloud-connected solutions.

Responsibilities

• Design and implement security architectures for embedded and IoT solutions.
• Define and maintain secure boot, firmware integrity, code signing, and OTA update strategies.
• Establish secure device provisioning, onboarding, and lifecycle management processes.
• Conduct threat modeling, security risk assessments, and security reviews throughout the product lifecycle.
• Assess and mitigate vulnerabilities across embedded devices, cloud platforms, and communication interfaces.
• Perform penetration testing, fuzz testing, and vulnerability assessments on embedded targets and IoT ecosystems.
• Drive secure coding practices and perform security-focused code reviews.
• Collaborate with development, platform, and cloud teams to integrate security into CI/CD pipelines and development processes.
• Ensure compliance with applicable cybersecurity standards and regulatory requirements.
• Support incident response activities, vulnerability remediation, and continuous security improvement initiatives.
• Manage SBOM creation, maintenance, and software supply chain security activities.

Skills

Embedded security

IoT security

Threat modeling

Penetration testing

Secure coding

Code signing

CI/CD security

Data protection

Vulnerability assessment

Tools

JTAG

UART

SPI

I2C

Job description

Spyro Soft is looking for a Penetration Tester with deep expertise in embedded systems and IoT security to identify and exploit weaknesses across diverse environments. The role demands strong analytical skills and the ability to translate findings into actionable guidance for stakeholders.

You will design secure architectures for embedded and cloud-connected devices, conduct threat modeling, perform penetration and fuzz testing on interfaces like JTAG, UART, SPI and I²C, and help integrate