Embedded Product Security Engineer for IoT Devices

Optimum Communications Inc.; Bethpage (NY); On-site; USD 140,000 - 200,000; Full time

Job summary

Optimum Communications Inc. is seeking a Product Security Engineer focused on embedded security for video, broadband, and Wi-Fi devices in a Fortune 500-like setting. The role partners with engineering and product teams to enforce secure design, and to lead security initiatives across the product lifecycle.

You will influence product strategy, mentor teams, and help establish secure-by-design practices while staying current with threats and industry standards.

Qualifications

• Bachelor's degree in Computer Science, Electrical Engineering, or a related field.
• 5+ years of hands-on experience in software engineering and designing and delivering security-critical systems for internet-connected embedded devices.
• Proven expertise in embedded systems and product security, with a strong understanding of modern software development processes and methods, security best practices, threat modeling, and risk assessment.
• Excellent communication skills, both written and verbal, and the ability to communicate complex security concepts to technical and non-technical audiences, including senior leadership.
• Proven ability to establish credibility and build trust with engineers and operational staff.
• Expertise in conducting comprehensive threat modeling, risk assessments, and code reviews to identify and mitigate vulnerabilities.
• Experience utilizing and securing AI/ML models and AI-governance and risk management, and a willingness to learn more.
• Proficiency in secure SDLC practices and practical experience with CI/CD pipelines and DevOps tools.
• Experience overseeing vulnerability and threat management at the platform and device levels.
• Strong understanding of cryptography and key management use cases.
• In-depth knowledge of networking protocols, peripheral and firmware security, secure boot, embedded Linux security, Android or iOS security, and PKI.
• Experience working with security hardware such as TPMs and HSMs.
• Proficiency in C and C++ for embedded software development and one or more modern programming languages like Golang, Python, Node, and Java.
• Hands-on hardware security testing techniques (JTAG/SWD, UART, SPI/I2C), firmware extraction, fault injection, side-channel analysis.
• Familiarity with reverse engineering and analysis tools (Ghidra, IDA Pro, Binary Ninja).

Responsibilities

• Collaborate with engineering and product teams to integrate security and secure-by-default guardrails into the product lifecycle.
• Conduct Threat Modeling and Risk Assessments from early stages of development to identify and mitigate security risks.
• Perform rigorous security testing and reviews to uncover weaknesses and address vulnerabilities.
• Lead initiatives automating security processes from developer workstations to cloud, SaaS, and datacenter environments.
• Educate and mentor teams to foster a security-first culture through training and campaigns.
• Stay updated on threats and trends and proactively implement improvements.
• Contribute to incident response, investigate root causes, and implement corrective actions.
• Conduct penetration testing, reverse engineering, and vulnerability research against firmware and device software.
• Establish SBOM management, CVE triage, and vulnerability disclosure for connected devices.
• Define secure-by-design requirements aligned to IoT/embedded security standards (NIST IR 8259, ETSI EN 303 645, OWASP IoT Top 10).

Skills

Embedded security

Threat modeling

Security testing

CI/CD pipelines

Reverse engineering

Cryptography

C/C++ programming

Communication

Vulnerability management

TPM/HSM knowledge

Education

Bachelor's in CS/EE

Master's degree

Tools

Ghidra

IDA Pro

Binary Ninja

binwalk

QEMU

Debuggers

Job description

Optimum Communications Inc. is seeking a Product Security Engineer focused on embedded security for video, broadband, and Wi-Fi devices in a Fortune 500-like setting. The role partners with engineering and product teams to enforce secure design, and to lead security initiatives across the product lifecycle.

You will influence product strategy, mentor teams, and help establish secure-by-design practices while staying current with threats and industry standards.