Product & Application Security Engineer

Sungrow USA Corporation; United States; Remote; USD 140,000 - 160,000; Full time

Job summary

Sungrow USA Corporation is seeking a Product and Application Security Engineer to drive security across the full product lifecycle, spanning firmware, embedded systems, hardware-integrated applications, cloud services, and connected platforms. The role demands hands-on security expertise and collaboration with engineering teams to remediate vulnerabilities from device to cloud.

You will lead security assessments, embed secure-by-design practices, and guide remediation with cross-functional

Qualifications

• 6–10+ years of experience in product security, embedded security, application security, or IoT security.
• Hands-on experience across multiple stack layers: app, firmware, hardware interfaces, and cloud.
• Strong ability to perform manual code review and system-level threat analysis.
• Experience with security tooling across SAST, DAST, SCA, firmware analysis, and network testing.

Responsibilities

• Perform security assessments across applications, firmware, hardware interfaces, and cloud platforms.
• Conduct code review, firmware analysis, and system-level security testing.
• Identify and validate vulnerabilities across the product attack surface and embed security into SDLC.
• Define and implement secure design patterns across application, device firmware, and communications.

Tools

SAST

DAST

SCA

Firmware analysis

Network testing

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Product & Application Security Engineer

Full Time Professional US

3 days ago Requisition ID: 1321

Salary Range: $140,000.00 To $160,000.00 Annually

About Sungrow:
Sungrow Power Supply Co., Ltd. (“Sungrow”) is a global leading PV inverter and ESS provider with 515 GW of power electronic converters installed worldwide as of December 2023. Founded in 1997 by University Professor Cao Renxian, Sungrow leads in the research and development of solar inverters with the largest dedicated R&D team in the industry and a broad product portfolio offering PV inverter solutions and ESS for utility-scale, commercial & industrial, and residential applications, as well as internationally recognized floating PV plant solutions, NEV driving solutions, EV charging solutions, and renewable hydrogen production systems. With a strong 27-year track record in the PV space, Sungrow products power in 170 countries and regions worldwide. For more information, visit: www.sungrowpower.com .

The Position:
Sungrow Americas is seeking a Product and Application Security Engineer to execute security across the full product ecosystem - - spanning firmware, embedded systems, hardware-integrated applications, cloud services, and connected platforms.

This role is responsible for deep technical security execution across the entire product lifecycle, ensuring that security is embedded from device to cloud to application layer.

You will serve as the hands-on technical authority, working directly with engineering teams to identify, validate, and remediate vulnerabilities across software, firmware, hardware interfaces, and system integrations.

This is a high-depth, cross-domain role, ideal for an engineer who can move fluidly between code, devices, protocols, and cloud architectures.

Key Responsibilities

Full-Stack Product Security

• Perform security assessments across:
  • Applications (web, APIs, backend services)
  • Firmware and embedded systems
  • Hardware interfaces and device communications
  • Cloud-connected platforms and IoT ecosystems
• Conduct code review, firmware analysis, and system-level security testing
• Identify and validate vulnerabilities across the entire product attack surface
• Embed security into SDLC across software, firmware, and device-integrated systems
• Define and implement secure design patterns across:
  • Application layers
  • Device firmware
  • Communication protocols
• Partner with engineering to ensure secure-by-design architecture decisions

Offensive Security & Validation

• Perform and support penetration testing, firmware analysis, and device-level assessments
• Validate findings from internal testing, third-party assessments, and teardowns

Vulnerability Management

• Triage and validate vulnerabilities across software, firmware, and hardware layers

  Vulnerability Management

  • Triage and validate vulnerabilities across software, firmware, and hardware layers
  • Provide clear, actionable remediation guidance tailored to engineering teams
  • Track and drive remediation aligned to risk and customer impact

  Software & Hardware Supply Chain Security

  • Support SBOM/HBOM analysis and validation
  • Identify risks in third-party libraries, firmware components, and hardware dependencies
  • Assist in mitigation strategies across supplier-integrated components

  Emerging Technology & Advanced Systems Security

  • Evaluate security risks in:
    • IoT architectures and edge devices
    • Cloud-native and distributed systems
    • Agentic / autonomous system behaviors (where applicable)
  • Help define guardrails for secure adoption of new technologies
  • Act as a trusted technical partner to software, firmware, and hardware teams
  • Translate security findings into practical engineering fixes
  • Provide real-time guidance during development, not just post-testing
  • Contribute to a culture of security ownership within engineering

  AI & Automation

  • Experience leveraging AI/ML-assisted tools to improve security engineering outcomes, including:
  • Code analysis and vulnerability detection
  • Secure code generation and review validation
  • Automation of repetitive security testing and triage tasks
  • Ability to integrate AI capabilities into engineering workflows, including:
    • API-based integrations with development and security tooling
    • Automation of security processes within CI/CD pipelines
  • Working understanding of security risks associated with AI-enabled systems, including:
    • Prompt injection and model misuse
    • Data exposure and model leakage risks
    • Secure handling of sensitive data in AI workflows
  • Practical ability to build lightweight automation and tooling (scripts, integrations, or pipelines) to scale security operations

  Requirements

  • 6–10+ years of experience in product security, embedded security, application security, or IoT security
  • Hands-on experience across multiple layers of the stack, including:
    • Application security (OWASP, API security)
    • Firmware or embedded systems
    • Network protocols and device communications
  • Strong ability to perform:
    • Manual code review
    • Firmware analysis (static/dynamic)
    • System-level threat analysis
  • Experience with security tooling across SAST, DAST, SCA, firmware analysis, and network testing
  • Working knowledge of modern architectures (cloud, microservices, device-cloud integration)
  • Ability to leverage Ai.
    

  Preferred

  • Experience with industrial systems, energy, or OT environments
  • Familiarity with hardware security concepts (secure boot, TPM, hardware roots of trust)
  • Experience with reverse engineering or low-level debugging
  • Exposure to SBOM/HBOM frameworks and supply chain security models (SLSA, etc.)
  • Certifications such as OSCP, OSCE, OSWE, GXPN, or similar
  • Cross-Domain Depth: Comfortable moving between firmware, hardware interfaces, applications, and cloud
  • Hands-On Operator: Executes, tests, breaks, and fixes—not just advises
  • Systems Thinker: Understands how components interact across the full product lifecycle
  • Engineering Credibility: Earns trust through technical accuracy and practical solutions
  • Adaptable Problem Solver: Effective in complex, evolving product environments

  Travel

  Up to 10%

  Work Location and Status:

  • Full-time position
  • Remote

  Sungrow is an equal opportunity employer. Due to strong interest in this position, Sungrow will only contact candidates who best meet the requirements. Thank you for your interest in Sungrow.