{"id":3923754,"url":"https://alion.io/job/arrow-electronics-product-security-embedded-iot","title":"Product Security- Embedded / IoT","company":{"id":1757520,"name":"Arrow Electronics","domain":"arrow.com","url":"https://alion.io/company/arrow-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"C","score":61,"open_postings":117,"ghost_share":0.726,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":7,"computed_at":"2026-11-07T05:47:08Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Ahmedabad, India","Pune, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"C++","optional":false},{"name":"Ghidra","optional":false},{"name":"Linux","optional":false},{"name":"MQTT","optional":false},{"name":"Nmap","optional":false},{"name":"OpenOCD","optional":false},{"name":"Python","optional":false},{"name":"RTOS","optional":false},{"name":"SBOM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Wi-Fi","optional":false},{"name":"Wireshark","optional":false}],"status":"live","first_seen_at":"2026-10-15T00:00:00Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-11-07T17:19:44Z","board_verified":true,"closed_at":null,"days_open":23,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":23},"description":"Position:\nProduct Security- Embedded / IoTJob Description:\nJob Description: Product Security Engineer, Embedded / IoT\n\nExperience: 2 to 10 years \nRole Overview\nWe are looking for product security professionals with hands-on experience in assessing and securing embedded systems and IoT products.\nThe role involves performing product security assessments, conducting VAPT, developing threat models and security requirements, reviewing security controls, and supporting SSDLC activities. The selected candidate will work closely with hardware, firmware, software, and product engineering teams to identify vulnerabilities, recommend practical mitigations, and validate remediation.\nKey Skills\nUnderstanding of embedded product architecture, microcontrollers, processors, bootloaders, memory, storage, and embedded Linux and/or RTOS environments. Ability to interpret hardware block diagrams, relevant schematic sections, and firmware architecture. \nHands-on experience assessing debug, programming, or communication interfaces such as UART, JTAG/SWD, SPI, I²C, and USB. Familiarity with device debugging, flash access, firmware acquisition, and evaluation of debug and readout protections. \nExperience with firmware extraction or acquisition, unpacking, filesystem analysis, configuration review, and static and/or dynamic analysis. Ability to identify hardcoded credentials, exposed secrets, insecure services, weak permissions, vulnerable components, and weaknesses in firmware update mechanisms. \nExperience conducting manual and tool-assisted security testing of physical devices, firmware, and exposed interfaces. Ability to validate vulnerabilities, distinguish false positives, demonstrate impact safely, and recommend relevant remediation. \nWorking knowledge of threat modeling, attack-surface analysis, security risk assessment, product security requirements, secure design review, and security validation. Understanding of assets, data flows, trust boundaries, attack scenarios, and requirement-to-test traceability. \nUnderstanding of secure boot, firmware signing, secure OTA updates, rollback protection, authentication, authorization, cryptographic key storage, certificate management, secure communications, and production security configuration. \nKnowledge of TCP/IP and relevant embedded or IoT interfaces and protocols, such as Ethernet, Wi-Fi, BLE, CAN, MQTT, HTTP(S), and TLS. Experience capturing and analyzing traffic and assessing communication security. \nAbility to understand C/C++ code and develop or modify Python or shell scripts. \nExperience with relevant tools such as Ghidra or IDA, Binwalk, GDB, OpenOCD, Wireshark, Nmap, flash programmers, debug probes, and logic analyzers. \nFamiliarity with SAST, SCA, and Software Bill of Materials (SBOM) analysis. \nJob Responsibilities\nReview product architecture, hardware and firmware designs, interfaces, deployment environments, and use cases to identify assets, attack surfaces, trust boundaries, and security risks. \nPlan and execute hardware and firmware VAPT using black-box, grey-box, or white-box approaches, as applicable. Assess physical access, debug interfaces, firmware, operating-system configuration, services, communication interfaces, and device management interfaces. \nPerform firmware analysis, binary analysis, reverse engineering, and security-focused source code reviews where applicable. Investigate vulnerabilities and document reproducible evidence, root causes, and product impact. \nDevelop and maintain threat models, security risk assessments, product security requirements, security test plans, test cases, and traceability records throughout the product lifecycle. \nReview and validate security controls, including secure boot, signed firmware updates, rollback protection, credential handling, access control, secure communications, and debug restrictions. \nExecute or review SAST, SCA, and firmware/binary scanning results. Analyze SBOMs, assess vulnerability applicability, eliminate false positives, and prioritize findings based on exploitability, exposure, and product impact. \nPrepare technical reports with findings, evidence, risk ratings, and actionable remediation recommendations. Collaborate with engineering teams, verify fixes, and document residual risks. \nDevelop reusable testing scripts, procedures, and checklists. Support security activities within development and release workflows and assess newly disclosed vulnerabilities affecting supported products. \nLocation:\nIN-GJ-Ahmedabad, India-Ognaj (eInfochips)Time Type:\nFull timeJob Category:\nEngineering Services","description_format":"text","description_chars":4583,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Wholesale","IT Resellers & VARs","Electronic Components Distribution"],"lifecycle":[{"event":"open","at":"2026-11-07T17:19:44Z"}],"visa":[],"liveness":{"score":14,"band":"cold","label":"Long shot","p_open":1,"p_active":0.389,"p_room":0.35,"age_days":23,"expected_fill_days":7,"reasons":["conf:2","win:tail","comp:junior,brand"],"computed_at":"2026-11-07T19:23:45Z"},"pay":null,"html_url":"https://alion.io/job/arrow-electronics-product-security-embedded-iot","json_url":"https://alion.io/job/arrow-electronics-product-security-embedded-iot.json","meta":{"generated_at":"2026-11-07T19:23:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30078,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1757520},"rest":"https://alion.io/mcp/rest/get_company?id=1757520"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farrow-electronics-product-security-embedded-iot"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farrow-electronics-product-security-embedded-iot"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farrow-electronics-product-security-embedded-iot"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arrow-electronics-product-security-embedded-iot\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farrow-electronics-product-security-embedded-iot"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3923754}},{"tool":"search_jobs","arguments":{"company":"arrow.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3923754},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}