Sr. Product Security Engineer

Be a part of our mission! As a world leader in creating comfortable, sustainable, and efficient climate solutions for buildings, homes and transportation, it's our responsibility to put the planet first. For us at Trane Technologies, and through our businesses including Trane® and Thermo King, sustainability is not just how we do business—it is our business. Do you dare to look at the world's challenges and see impactful possibilities?

Do you want to contribute to making a better future? If the answer is yes, we invite you to consider joining us in boldly challenging what's possible for a sustainable world. Learn about our benefits designed for you to Thrive at work and  boldly go. Where is the work:
Monday to Thursday, work onsite with your colleagues. Fridays, choose your work location, balancing what your work requires.

Thermo King is hiring an experienced Senior Product Security Engineer to work on the creation and implementation of secure embedded software by demonstrating a comprehensive understanding of secure by design principles to support the next-generation transport refrigeration and mobile HVAC controls platform while meeting vehicle cybersecurity and software-update regulatory type-approval requirements. In this role, you will lead the cross-product efforts to regularly assess threats and vulnerabilities, perform Security DFMEA, and review penetration tests & threat modeling reports on products throughout its lifecycle.

You will use the findings from new threats to improve processes and productivity by providing guidance and implementing priority updates based on findings. Your tasks include developing and capturing requirements, coordinating implementation, and helping the team to deliver product security goals. You will work closely with Systems, Hardware, Software, and teams to understand customer needs, align product security with overall practices, and define effective product security solutions and oversee their development.

• Risk Management:
  
  Assess product security risks in a maintained register, develop comprehensive mitigation strategies, and evaluate technical and business trade-offs.
• Lead Security
  
  Activities:
  
  Apply the Secure Development Lifecycle and lead product security processes including architectural analysis, threat modeling, security DFMEA, penetration testing, attack modeling and simulation, cybersecurity type-approval activities including TARA per ISO/SAE 21434, and data privacy impact assessments.
• Vulnerability Management:
  Identify, evaluate, and verify security issues discovered through automated testing, penetration testing, and customer feedback. Maintain and track closure of vulnerability backlogs.
• Compliance & Standards:
  Interpret and enforce product security requirements, conduct vulnerability reviews, and ensure compliance with automotive and industrial cybersecurity regulations and standards (UNECE R155, UNECE R156, ISO/SAE 21434, ISO 24089, GB , IEC 62443, NIST, and applicable regional data-privacy laws).
• Regulatory Type Approval & Management Systems:
  Support vehicle cybersecurity and software-update type approval by maintaining Cyber Security Management System (CSMS) and Software Update Management System (SUMS) processes and evidence aligned to regulations and standards.
• Secure Updates & Cryptographic Assurance:
  Define and validate secure over-the-air and service-tool update paths, covering secure boot, hardware root of trust, PKI and certificate management, code signing, and anti-rollback protection across the zonal architecture and independent modules.
• Data Privacy Compliance:
  Apply privacy-by-design and support data-protection impact assessments to meet regional obligations such as GDPR, CCPA, LGPD, the EU Data Act, and California SB-327.
• Security Tools Oversight:
  Monitor outputs and effectiveness from all security tools integrated within the software development lifecycle.
• Technical Guidance:
  Advise, guide, and mentor cross-disciplinary engineering teams during the design, review, and implementation of security features.
• Assurance:
  Validate that software meets all functional, security, regulatory (cybersecurity compliance), and quality benchmarks particularly within industrial and transportation environments.
• Multi-region travel up to 5% may be required.

• Bachelor's or Master's degree in computer engineering, computer science, electrical engineering or related technical field with 5+ years of experience.
• Preferred that the…