Product Security Engineer

About Xerox Holdings Corporation

For more than 100 years, Xerox has continually redefined the workplace experience. Harnessing our leadership position in office and production print technology, we’ve expanded into software and services to sustainably power the hybrid workplace of today and tomorrow. Today, Xerox is continuing its legacy of innovation to deliver client-centric and digitally-driven technology solutions and meet the needs of today’s global, distributed workforce. From the office to industrial environments, our differentiated business and technology offerings and financial services are essential workplace technology solutions that drive success for our clients. At Xerox, we make work, work. Learn more about us at www.xerox.com.

Product Security Engineer

About the team

Xerox printers, multifunction devices, software and cloud services are used by enterprises, government agencies and regulated industries around the world. The Product Security team makes sure those products are designed, built and supported securely across their lifecycle, from threat modeling and secure development through vulnerability response and regulatory compliance.

About the role

As a Product Security Engineer, you will be the main security partner for product and application teams. You will help them design securely, find and fix vulnerabilities, and meet the security requirements our customers and regulators expect. The role spans embedded devices and firmware, desktop and server software, and cloud services, and offers broad exposure to a varied attack surface.

What you will do:

Secure design and development

• Act as a security consultant and primary point of contact for product and application teams, giving guidance on secure design, security requirements and vulnerability remediation.
• Perform and review threat models (for example, STRIDE) for devices, firmware, software and cloud services; triage identified threats and recommend mitigations.
• Conduct product and application security risk assessments, and evaluate remediation alternatives.
• Promote secure coding practices and help teams integrate security activities and tooling (SAST, DAST, SCA) throughout the Software Development Lifecycle (SDLC).
• Support teams in addressing weaknesses aligned with the OWASP Top 10, CWE Top 25 and Xerox security standards.

Vulnerability management and incident response

• Participate in the Product Security Incident Response Team (PSIRT): triage internally and externally reported vulnerabilities, analyze impact across product lines, assign CVSS scores, and coordinate fixes and security bulletins under the Xerox Vulnerability Management and Disclosure Policy.
• Support investigation of product security incidents, identify root causes and recommend measures to prevent recurrence.
• Track, prioritize and follow up on remediation to ensure timely resolution of security findings.
• Support Software Bill of Materials (SBOM) and third-party component risk management.

Standards and compliance

• Help product teams meet security requirements from regulations and certification programs such as the EU Cyber Resilience Act, FedRAMP, Common Criteria and FIPS 140-3.
• Develop and maintain product security guidance, standards and best practices.

Program and engagement

• Drive security awareness, office hours, knowledge-sharing sessions and other Product Security engagement activities.
• Support continuous improvement of the Product Security program through process enhancements, metrics and stakeholder feedback.
• Build strong relationships with technical and non-technical stakeholders, and influence security adoption without direct authority.
• Manage multiple priorities across several product teams.

Required qualifications

• 5+ years of information security experience, including at least 4 years of hands-on application or product security work, or equivalent experience gained through work, training, military service or education.
• Hands-on experience defining security requirements, performing security risk assessments and applying a secure SDLC.
• Experience performing or reviewing threat models.
• Strong knowledge of the OWASP Top 10, CWE Top 25, and common software vulnerabilities and their remediation.
• Experience using SAST, DAST and/or SCA tools and validating their findings.
• Working knowledge of at least one of C/C++, Java, Python or JavaScript, with the ability to read code to confirm and explain issues.
• Excellent communication, stakeholder management and consulting skills, and strong analytical and problem-solving abilities.

Preferred qualifications

• Experience securing embedded, IoT or Linux-based devices, including secure boot, firmware signing and update mechanisms.
• Experience with PSIRT operations, coordinated vulnerability disclosure, CVE and CVSS.
• Knowledge of applied cryptography and PKI, including awareness of post-quantum cryptography migration.
• Familiarity with the EU Cyber Resilience Act, FedRAMP, Common Criteria, FIPS 140-3 or similar programs.
• Cloud security experience (for example, AWS or Azure).
• Penetration testing, fuzzing or reverse engineering experience.
• Relevant certifications such as CSSLP, GIAC (GWEB, GSSP), OSCP or CISSP.
• Bachelor’s degree in computer science, Computer Engineering, Cybersecurity or a related field, or equivalent experience.