Senior Product Security Engineer

Senior Product Security Engineer page is loaded## Senior Product Security Engineer remote type:
Hybrid locations:
Milwaukee, Wisconsin, United Statestime type:
Full time posted on:
Posted Yesterday job requisition :
R25-4264

Rockwell Automation is a global technology leader focused on helping the world’s manufacturers be more productive, sustainable, and agile. With more than 28,000 employees who make the world better every day, we know we have something special. Behind our customers - amazing companies that help feed the world, provide life-saving medicine on a global scale, and focus on clean water and green mobility - our people are energized problem solvers that take pride in how the work we do changes the world for the better.

We welcome all makers, forward thinkers, and problem solvers who are looking for a place to do their best work. And if that’s you we would love to have you join us!

Job Description ###

Position Summary:

The Product Security Engineer secures embedded products, firmware, and industrial components across the full product lifecycle.

Your role combines firmware security, secure architecture, reverse engineering, and secure development lifecycle practices. You will report to the Product Security Leader/Officer (PSL) and partner with engineering teams through the engineering Vee to mature security controls in high-visibility industrial products used worldwide.

This role is not in IT security, nor Operational Security. You will work with Product Engineering Teams. You will get to see your secured products manufactured then sold and placed into Operational Technology Environments.

You will assess vulnerabilities, analyze SBOM and CVE data, model threats, score risk, and support secure-by-design decisions. You will help create and refine security controls such as secure boot, trusted hardware, cryptographic protections, and secure update mechanisms. You will also assist teams during design reviews, testing, debugging, and remediation activities.

You will evaluate diagnostics, logs, test results, and firmware images to identify weaknesses or anomalies. You will have lifecycle responsibility for threat model components which will be used by Security Champions for Models. The components will use VAST, LINDDUN, IEC 62443, NIST 800-53/800-82, and Common Criteria evaluation techniques. You will lead evaluations of Threat model Dispositions. You will help ensure products meet secure software development framework (SSDF) Dev Sec Ops  processes and support operational security requirements for products which are deployed in OT environments.

This is a product security engineering role focused on embedded systems, firmware, industrial protocols, and secure architecture. It is not an IT Security, Network Security, or Operational Security role. The work directly supports downstream SOC, audit, and enterprise cybersecurity teams by ensuring products are secure from the start.### Your Responsibilities:
* Embedded & Firmware Security
** Design, review, and improve security controls for firmware, bootloaders, trusted hardware, and cryptographic modules.
* Analyze firmware and binaries using tools such as Ghidra, IDA Pro, Binary Ninja, or similar.
* Support secure coding practices for C/C++ and embedded operating systems.
* Security Architecture & Cross-Team Collaboration
** Partner with architects and engineering leads to apply secure design principles.
* Support architecture reviews and technical discussions for products in the entire spectrum of their life cycle from cradle to grave.
* Align engineering teams with secure development frameworks such as SSDF, DSOD, and secure lifecycle processes.
* Provide applicable recommendations and rationale to help resolve security design decisions.
* Threat Modeling & Vulnerability Analysis
** You will support threat models components as part of the Secure Development Life Cycle process. Your components will use VAST, LINDDUN, IEC 62443, NIST 800-53/82, CAPEC, Emb3d, ATT&CK, OWASP and Common Criteria frameworks.
* Identify attack surfaces, trust boundaries, misuse cases, and system risks.
* Evaluate SBOM data, CVEs, CWE/CAPEC mappings, and analysis reports.
* Document risk…