Security Engineer

Overview

Senior Security Engineer, a hands-on product security role building and supporting the Copeland Product Security Program, working with product development teams to assess, design, test and improve the security of Copeland products and services across their lifecycle.

What you'll do

• Perform product security testing and reporting, including black-box reverse engineering of hardware and firmware, vulnerability research, exploit development, fuzz testing, protocol reverse engineering, hardware security assessments and embedded software security reviews.
• Conduct manual penetration testing of mobile applications (iOS and Android), web applications, APIs and microservices, cloud infrastructure, network systems and IoT devices.
• Facilitate threat modeling with product, application, infrastructure and engineering teams.
• Conduct architecture and design reviews to identify security weaknesses early in the development lifecycle.
• Support Secure Development Lifecycle (SDL) activities and Secure-by-Design initiatives.
• Review security requirements for connected products and cloud-based solutions.
• Partner with engineering teams to develop effective security controls and mitigations.
• Support Product Security Incident Response Team (PSIRT) operations, including investigating and validating externally reported vulnerabilities and coordinating triage, remediation and disclosure.
• Participate in CVE identification, CVSS scoring and security advisory development.
• Engage with security researchers, vulnerability disclosure programs and industry partners.
• Assist with incident response activities involving Copeland products.
• Perform security assessments of AI/ML and Generative AI-enabled products and services, evaluating risks associated with AI agents, model supply chains, prompt injection, model poisoning and data leakage.
• Help define security controls for AI-powered products and services and assess third-party AI technologies and integrations for security risk.
• Perform security training and outreach to development and engineering teams.
• Support security champion programs and secure coding initiatives.
• Maintain product security metrics, documentation, dashboards and operational procedures.
• Assist with continuous improvement of product security tools and processes.
• Support cybersecurity compliance initiatives for connected products, including vulnerability management and reporting obligations under cybersecurity regulations and standards.
• Collaborate with legal, compliance and product teams during product security investigations and regulatory reporting activities.
• Support readiness for regulations such as the EU Cyber Resilience Act (CRA), coordinated vulnerability disclosure processes and secure product development requirements.

What you'll need

• Bachelor's degree in Computer Science Engineering, Cybersecurity, Information Technology or a related field, or equivalent practical experience.
• Minimum of 5 years of experience with any combination of embedded systems and IoT security, red teaming or penetration testing.
• Experience conducting security testing of embedded hardware and the ability to identify and manipulate debug interfaces (UART, JTAG, SWD, etc.) and peripheral buses (SPI, I2C, etc.).
• Experience performing binary reverse engineering of ARM, MIPS and PowerPC firmware using industry-standard tools such as IDA Pro, Binary Ninja, Ghidra, etc.
• Experience planning and executing Red Team exercises.
• Experience performing fuzz testing of industrial communication protocols such as Wi-Fi, BLE, Wireless HART, PROFINET, MODBUS, Ethernet IP, OPC UA, HART or FF.
• Understanding of secure boot processes, bootloaders, cryptographic implementations and trusted execution concepts.
• Understanding of network, web, IoT and industrial protocols such as TCP/UDP, HTTPS, MQTTS, CoAP, Modbus, Ethernet/IP, DNP3 and OPC-UA.
• Excellent written and verbal communication skills.
• Strong analytical skills and problem-solving capabilities.

Nice to have

• Experience supporting PSIRT operations, including vulnerability triage, CVSS scoring, authoring security advisories and coordinated vulnerability disclosure activities.
• Understanding of cybersecurity regulations affecting connected products, including EU Cyber Resilience Act (CRA), IEC 62443 and NIST Secure Software Development Framework (SSDF).
• Experience working with cloud security architectures and cloud platforms such as AWS, Azure and Google Cloud.
• Experience with programming languages such as Python, C, C++, C#, Assembly, Go and Rust.
• Experience with software supply chain security, including SBOM generation and analysis, Software Composition Analysis (SCA) and CI/CD security.
• Knowledge of embedded Linux is required; knowledge of Real-Time Operating Systems is a plus.
• Hands-on experience assessing AI/ML systems, Generative AI applications, LLM-based applications and autonomous agents.
• Familiarity with MITRE ATT&CK, OWASP Top 10 and OWASP Top 10 for LLM Applications.

Details

• Location: Pune, India.