Product Security & Compliance Engineer
Core
Ensure connected hardware and cloud services are secure, resilient, and compliant with regulatory requirements like RED, EN 18031, and the Cyber Resilience Act.
Role type
Product Security & Compliance Engineer
Builds
Secure IoT devices, firmware, and cloud services for the Home Assistant ecosystem
Domain
IoT, Embedded Systems, Cloud Security, Regulatory Compliance (EU RED, CRA)
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
embedded/firmware security, network security, application security, cloud security, threat modeling, vulnerability scanning, SAST/DAST, SBOM management, secure boot validation, regulatory compliance interpretation
Preferred skills
CE/RED conformity experience, Cyber Resilience Act preparation, firmware security on constrained devices, secure OTA updates, CI/CD security integration, GDPR privacy-by-design, open-source project collaboration
Technologies
SAST, DAST, SBOM tools, firmware analysis tools, network security testing tools
Responsibilities
Own cybersecurity aspects of regulatory compliance for connected hardware; Prepare products for EU Cyber Resilience Act; Create architecture and data-flow diagrams; Perform threat modeling and translate risks into security requirements; Conduct hands-on product security validation (vulnerability scanning, penetration testing); Generate and maintain SBOMs; Validate security mechanisms (authentication, secure boot, signed updates); Translate security assessments into compliance evidence and documentation; Collaborate with hardware, firmware, cloud, and product teams; Coordinate with ODMs and external certification bodies; Provide privacy-by-design input for cloud services; Track product conformity status and regulatory deadlines
Seniority
Mid-Senior, hands-on IC
