Firmware Manager, CRA Compliance - Cargo

About Us

We are a global climate technologies company engineered for sustainability. We create sustainable and efficient residential, commercial and industrial spaces through HVACR technologies. We protect temperature-sensitive goods throughout the cold chain. And we bring comfort to people globally. Best-in-class engineering, design and manufacturing combined with category-leading brands in compression, controls, software and monitoring solutions result in next-generation climate technology that is built for the needs of the world ahead.

We are seeking an experienced Firmware Engineering Manager to lead our embedded systems team with a dedicated focus on technical execution and regulatory alignment under the EU Cyber Resilience Act (CRA). In this role, you will lead a team of firmware engineers building secure, scalable IoT products while ensuring our entire embedded architecture and software development lifecycle (SDLC) meet mandatory EU cybersecurity requirements.

You will bridge the gap between low-level firmware development, security architecture, and regulatory compliance—ensuring our devices are secure by design, maintain continuous vulnerability management, and support robust over-the-air (OTA) updates throughout their support lifecycle.

• Secure Architecture:
  Drive the design and implementation of firmware security controls aligned with CRA standards (e.g., ETSI EN 303 645, IEC 62443, ISO 27001), enforcing Hardware Root of Trust, Secure Boot, encrypted memory partitions, and secure key storage.
• Automated SBOM & Dependency Management:
  Establish automated generation and maintenance of Software Bill of Materials (SBOM) (e.g., CycloneDX, SPDX) within build pipelines to maintain component transparency and track open-source dependencies.
• Over‑The‑Air (OTA) & Patch Management:
  Direct the development of secure, cryptographically signed, and resilient OTA update mechanisms capable of delivering rapid security patches without bricking devices in the field.
• Vulnerability & Incident Management:
  Implement processes to meet CRA reporting mandates—including 24-hour initial vulnerability alert capabilities, 72-hour notifications, and rapid patch deployment workflows.
• Conformity & Technical Documentation:
  Oversee technical file generation, risk assessments, and compliance testing required for CRA CE marking and third‑party conformity audits.
• People & Team Management:
  Lead, mentor, and grow a team of embedded firmware engineers, fostering a culture prioritizing security‑by‑design and security‑by‑default principles; balance feature delivery roadmaps with compliance deadlines, security debt reduction, and refactoring efforts; conduct code reviews, establish secure coding standards (MISRA, CERTC), and integrate SAST/DAST/fuzz testing tools into CI/CD build environments.
• Cross‑Functional
  
  Collaboration:
  
  Partner closely with Product Management, Hardware Design, Legal/Compliance, and Cloud IoT teams to align hardware selection (e.g., Secure Elements, TPMs) with security standards; serve as the technical point of contact for external auditors, compliance bodies, and security researchers conducting vulnerability assessments or penetration testing.

• Education:
  
  Bachelor’s or Master’s degree in Computer Engineering, Electrical Engineering, Computer Science, or equivalent practical experience.
• Experience:
  
  8+ years of experience in embedded firmware development (C/C++, RTOS, bare‑metal, or Embedded Linux), preferably for IoT devices; 3+ years of experience in an engineering management, tech lead, or supervisory role.
• Demonstrated experience implementing firmware security primitives:
  Secure Boot, cryptographic hardware (HSM, TPM, Secure Elements), TLS/mTLS, memory protection, and secure storage.
• Hands‑on knowledge of hardware/software security frameworks and regulatory compliance standards (e.g., EU Cyber Resilience Act, ETSI EN 303645, NISTSP
  800‑213, IEC
  62443).
• Authorization to work in the United States- sponsorship will not be provided for this role.

• Experience establishing automated SBOM pipelines and vulnerability scanning (e.g., CVE mapping).
• Deep…