3 months ago
India (city not specified)Staff+
Responsibilities
- Investigate reported and internally discovered vulnerabilities across embedded firmware and gateway platforms.
- Analyze embedded firmware packages, update mechanisms, and network, diagnostic, and field-service interfaces.
- Support secure boot, firmware signing, and update validation implementations with firmware engineering teams.
- Conduct threat modeling and risk assessments for embedded platforms and exposed interfaces.
- Drive vulnerability response workflows, including root cause analysis, remediation tracking, and verification.
- Support alignment with IEC 62443, ISO 27001, NIS2, and CRA-related cybersecurity obligations.
- Review and maintain SBOMs and supplier security documentation for compliance and supply-chain security.
- Partner with QA and firmware teams on security testing, validation, and release readiness.
- Contribute to security requirements, checklists, and conformance matrices for embedded platforms.
Requirements
- Bachelor’s degree or foreign equivalent in Computer Science, Software Engineering, Mechanical Engineering, Electrical Engineering, Computer Engineering, or a related technical field, with strong emphasis on software.
- At least 3 years of experience resolving security issues in embedded firmware.
- At least 3 years of experience with Linux-based secure firmware development and testing.
- At least 3 years of experience using C/C++.
- Experience with embedded firmware or embedded Linux-based platforms.
- Working knowledge of secure boot, firmware signing, cryptography, and secure update mechanisms.
- Experience investigating or mitigating software vulnerabilities in embedded or product environments.
- Familiarity with networked embedded systems and protocols such as TCP/IP, TLS, and diagnostics interfaces.
- Ability to collaborate with cross-functional engineering, quality, and compliance teams.
- Preferred experience with IEC 62443, ISO/SAE 21434, or similar industrial/OT security frameworks.
- Preferred familiarity with SBOM formats and tooling such as CycloneDX and SPDX.
About Vertiv
Vertiv builds power, cooling, and IT infrastructure for data centers, communication networks, and industrial facilities, sold as hardware, software, and services. Its portfolio spans UPS systems, thermal management, racks, prefabricated modules, and monitoring/management software, backed by global field service and commissioning. Headquartered in Columbus, Ohio, Vertiv was formed from Emerson Network Power and became a publicly traded company on the NYSE.