Senior Product Security Engineer

Faith Technologies Inc; Menasha (WI); On-site; USD 140,000 - 190,000; Full time

Job summary

Faith Technologies Inc in Wisconsin seeks a Senior Product Security Engineer to lead security design and governance for IIoT and grid-connected products, spanning from early design through field deployment and ongoing operation.

This deeply technical role focuses on hardware and embedded security, OT/IT convergence, and applying industrial security standards. Collaborate with product, engineering, and customers to drive security excellence across the device lifecycle.

Qualifications

• Bachelor’s degree in Information Security or related field.
• 5+ years in product security, embedded/IIoT security, or OT/ICS security.
• 2+ years in a senior or lead capacity preferred.
• Travel: 5-10%.
• Standard work hours with flexibility to meet business needs.

Responsibilities

• Define and own security architecture for IIoT products (PKI, secure boot, key mgmt).
• Enforce security requirements based on IEC 62443, UL 2900, NIST CSF/802.1 etc.
• Design security boundaries for OT and IT convergence with defense-in-depth.
• Evaluate security of industrial protocols (IEC 61850, DNP3, Modbus, CAN).
• Lead threat modeling (STRIDE/PASTA) for new initiatives and features.
• Prioritize risks across fielded and in-development devices by impact and exploitable risk.
• Coordinate responses to vulnerabilities with product, engineering, and customers.
• Assess supply chain risk for embedded components and define security requirements.
• Act as SME for IIoT/OT security; provide guidance to architects and leadership.
• Own security standards, policies, and design review processes for IIoT devices.

Skills

Embedded security

IIoT security

OT/ICS security

Threat modeling

Security architecture

Education

Bachelor’s degree in Information Security

Tools

CI/CD security tooling

Job description

You’ve discovered something special. A company that cares. Cares about leading the way in construction, engineering, manufacturing and renewable energy. Cares about redefining how energy is designed, applied and consumed. Cares about thoughtfully growing to meet market demands. And — as “one of the Healthiest 100 Workplaces in America” — is focused on the mind/body/soul of team members through our Culture of Care.

The Senior Product Security Engineer leads the security design and governance of our Industrial Internet of Things (IIoT) and Grid connected product portfolio. Reporting to the Cybersecurity Manager, this role is the primary technical authority for IIoT product security across the entire device lifecycle – from early design through field deployment and ongoing operation. This is a deeply technical role focused on hardware and embedded systems security, OT/IT convergence, and the application of industrial security standards. Day‑to‑day development and DevSecOps execution (code scanning, firmware management, CI/CD pipeline tooling) is owned by the Product Security Engineer II; the Senior Engineer operates at the architectural, standards, and cross‑functional leadership level.

Minimum Requirements

• Bachelor’s degree or equivalent experience in Information Security, Electrical Engineering, Computer Engineering, or a related technical field.
• 5+ years of dedicated experience in product security, embedded/IIoT security, or OT/ICS security, with at least 2 years in a senior or lead capacity.
• Industry‑recognized security certifications preferred but not required (e.g., GICSP, CISSP, ISA/IEC 62443 Cybersecurity Certificate Program, CSSA).
• Travel: 5‑10%.
• Work Schedule: Typical work hours are between 7:00 a.m. and 5:00 p.m. Monday – Friday. However, work may be performed at any time on any day of the week to meet business needs.

Key Responsibilities

• Define and own the security architecture for connected IIoT products, including device identity frameworks (PKI/certificate management), secure boot chains, cryptographic key management, and hardware root of trust.
• Establish and enforce security design requirements based on applicable standards and frameworks (e.g., IEC 62443, UL 2900, NERC CIP, NIST SP 800-82, NIST CSF) across product lines.
• Design security boundaries and communication controls for environments where operational technology (OT) interfaces with enterprise IT systems, ensuring defense‑in‑depth across both layers.
• Evaluate and provide security guidance on industrial communication protocols used in energy and grid applications (e.g., IEC 61850, DNP3, Modbus, CAN bus, GOOSE/Sampled Values).
• Conduct and lead structured threat modeling exercises (e.g., STRIDE, PASTA) for new IIoT product initiatives and significant feature changes, translating identified risks into actionable design controls.
• Assess and prioritize security risks across fielded and in‑development device portfolios based on exploitability, potential impact to grid operations or physical safety, and business criticality.
• Serve as the technical lead for coordinating responses to security vulnerabilities identified in fielded IIoT products, including working with Product, Engineering, and customers on disclosure and remediation timelines.
• Evaluate hardware component and third‑party software supply chain risks, providing security requirements for procurement and vendor selection of embedded components.
• Act as the primary subject matter expert for IIoT and OT product security, providing high‑context technical consultation to product architects, engineering leads, and executive leadership.
• Own the product security standards, policies, and design review processes applicable to IIoT devices, ensuring teams have clear, actionable requirements before development begins.
• Partner with Hardware, Firmware, Systems Engineering, and Product Management teams to embed security requirements early in the product development process without creating unnecessary friction.
• Serve as the senior technical contributor during high‑severity security incidents involving fielded IIoT products, leading root cause analysis and driving architectural improvements to prevent recurrence.
• Coordinate with Threat Intelligence and engineering teams to document identified vulnerabilities and assist in drafting CVEs and public security advisories following successful remediation.

Technical Components

• Demonstrated expertise in securing embedded and IIoT devices, including secure boot, hardware security modules (HSMs), trusted execution environments (TEEs), and firmware security architecture.
• Working knowledge of industrial communication protocols common in energy and grid applications (IEC 61850, DNP3, Modbus, CAN bus) and their associated security considerations.
• Strong understanding of OT and ICT security principles, network segmentation strategies (e.g., Purdue Model, IEC 62443 zones and conduits), and the unique threat landscape of connected energy infrastructure.
• Solid understanding of public key infrastructure, certificate lifecycle management for device identity, and applied cryptography as it relates to constrained embedded environments.
• Deep familiarity with IEC 62443, UL 2900, NERC CIP, and NIST SP 800-82; ability to translate standards requirements into concrete, enforceable product security controls.
• Proven experience leading structured threat modeling sessions for hardware/firmware products in OT or energy environments.
• Performs other related duties as required and assigned.

The job description and responsibilities described are intended to provide guidelines for job expectations and the employee's ability to perform the position described. It is not intended to be construed as an exhaustive list of all functions, responsibilities, skills, and abilities. Additional functions and requirements may be assigned by supervisors as deemed appropriate.

Why Join FTI?

If you’re energized by new challenges, FTI provides you with many opportunities. Joining FTI opens doors to redefine what’s possible for your future. Once you’re a team member, you’re supported and provided with the knowledge and resources to achieve your career goals with FTI. You’re officially in the driver’s seat of your career, and FTI’s career development and continued education programs give you opportunities to position yourself for success.

FTI is a “merit to the core” organization. We recognize and reward top performers, offering competitive, merit‑based compensation, career path development and a flexible and robust benefits package.

Benefits

We provide industry‑leading benefits as an investment in the lives of team members and their families. You’re invited to review the full list of FTI benefits available to regular/full‑time team members. Start here. Grow here. Succeed here.

Faith Technologies, Inc. is an Equal Opportunity Employer – veterans/disabled.

Employment is contingent upon successfully passing a background and drug test.

Faith Technologies Incorporated (FTI) is a dynamic organization comprised of construction, engineering, manufacturing and renewable energy experts. We create success for our partners and team members through innovation and expertise, rethinking how energy is designed, applied and consumed and providing solutions that go beyond the ideas of today. With expertise across all our brands – Faith Technologies®, EnTech Solutions™ and Excellerate® – we are one connected company, bringing our partners’ visions to life to ensure a sustainable future.

FTI participates in E‑Verify; please review the E‑Verify Participation and Department of Justice, Immigrant and Employee Rights Section (IER) Right‑to‑Work posters to review your legal rights and protections as a prospective employee: E‑Verify Participation Poster (English/Spanish) IER Right‑to‑Work Poster (English/Spanish)