Senior PSIRT Security Engineer, Embedded & Semiconductor Products (m/f/d)

Description

The company's product security incident response team handles reports of vulnerabilities in its hardware, firmware, software and embedded platforms. This is a technical role in that team, working with product experts to reproduce issues, establish their real impact and recommend fixes.

Responsibilities

• Triage technical vulnerability reports covering the company's hardware, firmware, software, development tools and embedded platforms.
• Examine the preconditions, attack paths, trust boundaries, affected components and possible customer impact of each issue.
• Reproduce reported behaviour with product teams and confirm findings.
• Identify which product families, configurations, software versions and customer use cases are affected.
• Judge exploitability and severity from the technical evidence, using the applicable scoring methods.
• Record the technical reasoning behind severity, scope, affected products and remediation decisions.
• Write technically precise content for CVE records, security advisories, customer messages and researcher replies.
• Work directly with security researchers to clarify findings, request evidence and check coordinated disclosure materials.
• Point out recurring vulnerability patterns to product teams and suggest product security engineering improvements.
• Serve as a trusted advisor to product teams on vulnerability management and product security practice.
• Help improve PSIRT processes, metrics and day-to-day operations.

Requirements

• Experience in product security, embedded security, semiconductor security, cybersecurity or secure product development.
• At least 3+ years in a security-related role.
• A bachelor's or master's degree in engineering, computer science, electrical engineering, cybersecurity or a related field.
• Strong hands-on experience in one or more of: embedded security, hardware security, semiconductor security, firmware security, product security or vulnerability research.
• Working knowledge of embedded architectures, microcontrollers, microprocessors, secure elements, firmware, boot chains, hardware security features and low-level software.
• Ability to assess vulnerability reports, reasoning about attack preconditions, privilege boundaries, exploitability and product impact.
• Experience in at least one technical area such as C/C++, assembly, reverse engineering, firmware analysis, secure boot, cryptography, debug interfaces, hardware-assisted security, fault injection or side-channel analysis.
• Familiarity with vulnerability classification, CVE, CVSS, CWE, coordinated disclosure and writing security advisories.
• Experience in automotive, industrial, IoT, mobile, secure identification, connectivity or communication infrastructure products is advantageous.
• Strong collaboration and communication skills for working across teams.
• Fluent English.

Conditions

Full-time position.

Pay is benchmarked against the electronics and semiconductor industry. In Austria the role is graded in Employment Group V of the Kollektivvertrag für Angestellte Gewerbe und Handwerk und in der Dienstleistung, as required by the Austrian Equal Treatment Act.

Individual experience and expectations are taken into account during the application process.

Benefits

• Home office options.
• Flexible working hours.
• Meal benefits.