Product Security- Embedded / IoT
Arrow Electronics5 days ago
Pune, India or Ahmedabad, IndiaMid Level / Senior
Responsibilities
- Review hardware, firmware, product architecture, deployment environments, use cases, assets, attack surfaces, trust boundaries, and security risks.
- Plan and execute black-box, grey-box, and white-box hardware and firmware VAPT, including assessment of physical access, debug interfaces, firmware, operating-system configuration, services, communications, and device-management interfaces.
- Perform firmware analysis, binary analysis, reverse engineering, and security-focused source-code reviews; document reproducible evidence, root causes, and product impact.
- Develop and maintain threat models, security risk assessments, product security requirements, security test plans, test cases, and traceability records.
- Review and validate secure boot, signed firmware updates, rollback protection, credential handling, access control, secure communications, and debug restrictions.
- Execute or review SAST, SCA, firmware and binary scanning, and SBOM analysis; assess applicability, eliminate false positives, and prioritize findings.
- Prepare technical reports with findings, evidence, risk ratings, and remediation recommendations; collaborate with engineering teams to verify fixes and document residual risks.
- Develop reusable testing scripts, procedures, and checklists and support security activities in development and release workflows.
Requirements
- 2 to 10 years of experience in product security, embedded security, IoT security, or related work.
- Understanding of embedded architectures, microcontrollers, processors, bootloaders, memory, storage, embedded Linux, and RTOS environments, with the ability to interpret hardware diagrams, schematics, and firmware architecture.
- Hands-on experience assessing UART, JTAG/SWD, SPI, I²C, USB, device debugging, flash access, firmware acquisition, and debug or readout protections.
- Experience with firmware extraction or acquisition, unpacking, filesystem analysis, configuration review, static or dynamic analysis, and identification of credentials, secrets, insecure services, weak permissions, vulnerable components, and firmware-update weaknesses.
- Experience manually and with tools testing physical devices, firmware, and exposed interfaces; able to validate vulnerabilities, distinguish false positives, demonstrate impact safely, and recommend mitigations.
- Working knowledge of threat modeling, attack-surface analysis, security risk assessment, product security requirements, secure design review, and security validation.
- Understanding of secure boot, firmware signing, secure OTA updates, rollback protection, authentication, authorization, cryptographic key storage, certificate management, secure communications, and production security configuration.
- Knowledge of TCP/IP and embedded or IoT protocols including Ethernet, Wi-Fi, BLE, CAN, MQTT, HTTP(S), and TLS, including traffic capture and communication-security analysis.
- Ability to understand C/C++ code and develop or modify Python or shell scripts.
- Experience with Ghidra or IDA, Binwalk, GDB, OpenOCD, Wireshark, Nmap, flash programmers, debug probes, and logic analyzers.
- Familiarity with SAST, SCA, and Software Bill of Materials analysis.
Benefits
- Full-time position located in Ahmedabad, Gujarat, India, at eInfochips.
About Arrow Electronics
Arrow Electronics (NYSE:ARW) guides innovation forward for thousands of leading technology manufacturers and service providers. With 2025 sales of $30.9 billion, Arrow develops technology solutions that help improve business and daily life. Our broad portfolio that spans the entire technology landscape, helps customers design, distribute and deploy forward-thinking products that make the benefits of technology accessible to as many people as possible. Learn more at arrow.com. Are you thinking Five Years Out? Join us at careers.arrow.com.