Product Security Engineer II
Schneider Electric7 hours ago
Kolding, Denmark or Andover, United KingdomMid Level
Base Salary
$118k - $176k/yr
Responsibilities
- Triage and prioritize vulnerability reports from Snyk, Dependabot, container scanning, Nessus, security teams, researchers, and testing firms using CVSS 3.1/4.0.
- Coordinate internal and external penetration testing, reproduce and validate findings, verify fixes, and support coordinated vulnerability disclosure with PSIRT.
- Lead security reviews for product releases and collect the evidence and artifacts required for release approval.
- Maintain risk assessments, threat models, security documentation, customer security information, and SBOMs for released products.
- Review designs and Java/Spring and TypeScript code for authentication, authorization, SSRF, XXE, path traversal, session management, logging, and secrets-management vulnerabilities.
- Guide or implement remediation, develop negative security tests, and define security-hardening requirements for appliances and customer-managed Linux environments.
- Partner with DevOps on security scanning in build pipelines and support release and package signing.
Requirements
- 7+ years of experience in software engineering or cybersecurity, including 3+ years in product or application security.
- Ability to review Java/Spring, TypeScript, and Linux configurations to investigate and validate security findings.
- Hands-on experience with SCA and vulnerability scanning tools, CVSS, CWE, and OWASP Top 10.
- Working knowledge of IEC 62443-4-1/4-2, NIST SSDF, or comparable secure development standards.
- Knowledge of applied cryptography, FIPS 140-3 modes, PKI/TLS, LDAP, SAML, OAuth2, container/Kubernetes security, and SBOM formats such as CycloneDX or SPDX.
- Experience triaging externally reported vulnerabilities and supporting coordinated vulnerability disclosure.
- Strong communication skills with developers, product managers, Legal, customers, security researchers, and external testing organizations.
- Preferred: experience with cybersecurity legislation such as the EU Cyber Resilience Act and with penetration-testing or external security-testing programs such as CyTRICS.
- Preferred: ability to implement security fixes in Java/Spring or TypeScript and experience using AI-assisted tools for secure code review or vulnerability discovery.
- Preferred: relevant security certification such as GIAC GWEB, OSWE, CKS, or CSSLP.
Benefits
- Expected U.S. pay range is USD 117,600–176,400 per year, including base pay and short-term incentives.
- Benefits include medical, dental, vision, basic life insurance, flexible work arrangements, paid family leave, well-being programs, 12 holidays, and 15 days of paid time off per year.
- Future-planning benefits include company share ownership and a 401(k) with match.
- Professional development includes performance discussions, global opportunities, the Schneider Career Hub, and Coursera learning platforms.
- Additional support includes volunteer leave, Schneider Electric Foundation programs, youth education initiatives, military leave benefits, and an inclusive workplace.
Tech Stack
Categories
About Schneider Electric
Schneider Electric builds electrical distribution equipment, industrial automation systems, and energy-management software and services for buildings, data centers, factories, and utilities. Founded in 1836 and headquartered in Rueil-Malmaison, France, it is a public company listed on Euronext Paris. The company sells globally through direct and partner channels in 100+ countries, with offerings such as switchgear, circuit protection, building management, microgrids, and the EcoStruxure software suite.