Platform Security Software Engineer

The Software Engineer, Platform Security and API Services will help harden the Control4 controller platform: the embedded Linux system, C++ services, and API layer that connect Control4 home automation controllers to every mobile app, touch screen, and cloud service in the Control4 smart home portfolio. Working with senior platform and security engineers, you will fix vulnerabilities in C++ system services, implement hardening and secure-by-default changes, and build the tooling and evidence that supports compliance with the EU Cyber Resilience Act and the US Cyber Trust Mark. You will also contribute to the Node.js REST, WebSocket, and GraphQL services that serve as the authenticated entry point for all client applications, including the enforcement of role-based access control. You will work from our Belgrade office alongside our existing platform engineer and with teams in the United States. This role fits an engineer with solid C++ fundamentals who wants to grow into security engineering on a shipping consumer platform; backend API experience is a plus.

JOB DUTIES:

• Reproduce, triage, and fix security vulnerabilities in C++ system services on embedded Linux controllers
• Implement platform hardening changes: least privilege, secure defaults, and compiler hardening
• Implement and test changes to the update, device identity, and token validation paths according to reviewed designs
• Fix defects and implement endpoints, resolvers, and authorization checks in the controller's Node.js REST, WebSocket, and GraphQL API services.
• Build SBOM generation, vulnerability scanning, sanitizer builds, and fuzzing into CI and keep them green
• Fix penetration test findings with tests that prevent regression, and document what was built and how it was verified
• Participate in security-focused design and code reviews

YOU MUST HAVE:

• 2+ years of professional software engineering experience in modern C++ on Linux
• Understanding of common C and C++ vulnerability classes and hands-on experience with at least one detection tool (sanitizers, static analysis, or fuzzing).
• Working knowledge of Linux fundamentals and a basic understanding of TLS, certificates, and JWT
• Experience with automated testing and CI/CD pipelines
• Interest in security and compliance, with willingness to learn the EU Cyber Resilience Act and NIST consumer IoT requirements on the job
• Clear written and verbal communication in English.

WE VALUE:

• JavaScript or TypeScript and Node.js API experience (REST or GraphQL), including GraphQL schema and resolver work
• Event-driven messaging (WebSockets, Socket.IO, MQTT) or Rust experience
• Security coursework, secure coding experience, or capture-the-flag participation
• Embedded Linux, Yocto, ARM, or cross-compilation exposure
• Familiarity with a security standard (CRA, EN 303 645, NIST IR 8425, IEC 62443) or SBOM tooling

WHAT'S IN IT FOR YOU:

• Health insurance through Generali
• Insurance in case of serious illness, surgical intervention, professional illness, and insurance from the consequences of an accident
• Sports and Recreation - Fitpass or Sports Academy Kocovic
• English classes during working hours
• Employee referral bonus program
• Corporate social events and team buildings
• Well-equipped office