Sr. Product Security Engineer
Trane Technologies1 day ago
Minneapolis, MN, USASenior
Base Salary
$105k - $169k/yr
Responsibilities
- Assess product security risks, maintain risk and vulnerability registers, and develop mitigation strategies.
- Lead secure development lifecycle activities including architectural analysis, threat modeling, Security DFMEA, penetration testing, attack modeling, simulation, TARA, and privacy impact assessments.
- Identify, evaluate, verify, and track closure of vulnerabilities found through automated testing, penetration testing, and customer feedback.
- Interpret and enforce product security requirements and ensure compliance with automotive, industrial, cybersecurity, software-update, and data-privacy regulations.
- Support vehicle cybersecurity and software-update type approval by maintaining CSMS and SUMS processes and evidence.
- Define and validate secure over-the-air and service-tool update paths, secure boot, hardware roots of trust, PKI, certificate management, code signing, and anti-rollback protection.
- Advise and mentor cross-disciplinary Systems, Hardware, and Software engineering teams on security design and implementation.
- Monitor the effectiveness of security tools integrated into the software development lifecycle and validate functional, security, regulatory, and quality benchmarks.
Requirements
- Bachelor’s or master’s degree in computer engineering, computer science, electrical engineering, or a related technical field.
- At least 5 years of experience.
- Embedded product security engineering experience is preferred.
- Automotive or vehicle cybersecurity, regulatory type approval, and secure over-the-air software update experience are strongly preferred.
- Experience with embedded software development and programming languages such as C, C++, C#, Rust, and Python.
- Expertise securing embedded controls platforms, including Embedded Linux and RTOS environments such as Yocto, FreeRTOS, Zephyr Project, and MicroC/OS-II.
- Experience with CAN J1939, CAN FD, SecOC, Automotive Ethernet, SPE, 100Base-T1, 10Base-T1S, MACsec, TLS 1.3, MQTT, and mutual TLS is preferred.
- Working knowledge of secure boot, hardware roots of trust, secure elements, PKI, code signing, and embedded key management.
- Familiarity with ISO/SAE 21434 TARA, UNECE R155, UNECE R156, ISO 24089, and GB 44495-2024 type-approval expectations.
- Strong understanding of static analysis, SAST, software composition analysis, vulnerability detection, and remediation.
- Familiarity with GitHub Actions, Azure DevOps, GIT, CppUTest, and Pluma.
- Strong communication, organizational, cross-functional collaboration, technical presentation, and continuous-improvement skills.
Benefits
- Benefits begin on day one and include health insurance and holistic wellness programs with incentives.
- Family-building benefits include fertility coverage and adoption and surrogacy assistance.
- Paid time off includes up to 15 vacation days, paid holidays, sick leave, volunteer leave, parental leave, and sick leave options.
- 401(k) match, educational and training programs, tuition assistance, and student debt support are available.
- Work onsite Monday through Thursday, with a choice of work location on Fridays.
- Multi-region travel of up to 5% may be required.
About Trane Technologies
Trane Technologies builds HVAC systems, controls, and energy services for commercial buildings and homes, and Thermo King transport refrigeration for trucks, trailers, and rail. It sells equipment, connected controls, and aftermarket service/maintenance contracts to building owners, contractors, and fleets. Founded in 1913, the company is publicly traded (NYSE: TT) and operates globally under the Trane and Thermo King brands from its global headquarters in Swords, Ireland.