Product Security Engineer

KAYGEN is an emerging leader in providing top talent for technology-based staffing services. We specialize in providing high-volume contingent staffing, direct hire staffing and project-based solutions to companies worldwide ranging from startups to Fortune 500 and Managed Service Providers (MSP) across a wide variety of industries.

The Product Security Engineer (Embedded) will support the security of physical, IoT, and embedded medical devices, including embedded Linux and Windows-based platforms, throughout the engineering and product development lifecycle.

The engineer will contribute to the development and delivery of secure products in alignment with applicable industry standards and global regulatory requirements. Working under the guidance of senior product security team members, this role will execute product security activities, identify and help mitigate security risks, and collaborate closely with software engineering, R&D, and other cross-functional stakeholders.

Key responsibilities include hands-on participation in threat modelling, vulnerability scanning and remediation, security risk assessments, secure design reviews, security requirements implementation, and product security documentation.

The ideal candidate will have developed technical expertise in embedded security, strong problem-solving abilities, and the ability to work effectively in an agile engineering environment. A positive work ethic, strong communication skills, and a commitment to project objectives are essential.

• Support engineering teams in defining and implementing security requirements and controls for products and product features.
• Contribute to the implementation of security technologies and controls, including:
• Encryption
• Authentication and authorization
• Audit logging
• Software Bill of Materials (SBOM)
• Patch management
• Vulnerability monitoring
• Antivirus and antimalware controls, where applicable.
• Help ensure security requirements align with applicable industry standards and regulatory expectations for medical and connected devices.

• Support the selection and implementation of appropriate cryptographic algorithms and security mechanisms.
• Assist with key management and secure key storage practices.
• Support certificate lifecycle management, including certificate issuance, renewal, and revocation.
• Apply foundational knowledge of cryptographic algorithms, hashing, key lengths, and encryption modes.

• Evaluate and support secure communications between devices, applications, networks, and cloud-connected components.
• Assist with validation of TLS/mTLS configurations and other secure communication mechanisms.
• Support security assessment of relevant medical, proprietary, wireless, or device-specific communication protocols.
• Assist in identifying and addressing security risks associated with cloud-connected products and device backends.
• Support security assessments of APIs, including authentication, authorization, and data protection.
• Apply foundational knowledge of protecting sensitive information in transit and at rest.

• Participate in technical design reviews and security-focused code inspections.
• Provide security recommendations and feedback to software engineers and R&D teams.
• Promote secure coding practices throughout the software development lifecycle.

• Support product security risk assessments, threat modeling, hazard analysis, and vulnerability management activities.
• Assist with vulnerability identification, analysis, prioritization, remediation, and verification.
• Review penetration testing and security assessment results and assist teams in implementing appropriate security controls.
• Work closely with software development teams to address identified security issues.

• Assist development teams with product security framework activities and processes.
• Contribute to security documentation, including:
• Incident and Vulnerability Management Plans
• Product Security White Papers
• Security assessment documentation
• Security test reports and supporting artifacts.
• Participate in product security incident response activities as appropriate.
• Assist with investigation, documentation, remediation, and follow-up activities related to…