Senior Security Engineer - IOT

eInfochips · Ahmedabad

Collected role description

<h1>Position:</h1>Senior Security Engineer - IOT<h1>Job Description:</h1><h3>Experience:</h3>2–6 years of relevant experience in system security, embedded systems, and vulnerability assessments.<h3>Key Skills:</h3><ul><li>Firmware Analysis Tools: Expertise in using firmware analysis tools such as Ghidra, Binwalk, and Radare2 for static and dynamic analysis of firmware images.</li><li>Embedded Linux Platforms: In-depth knowledge of embedded Linux, Yocto, and OpenWRT platforms for secure firmware and OS testing.</li><li>Secure Boot & Firmware Update Mechanisms: Proficiency in testing secure boot processes and firmware update mechanisms, ensuring integrity and authenticity.</li><li>OS Hardening & Security Configurations: Strong understanding of OS hardening techniques and security configurations to mitigate threats and enhance system integrity.</li><li>Vulnerability Assessment & CVE Analysis: Extensive experience with vulnerability assessment frameworks and CVE analysis, identifying and addressing security vulnerabilities in embedded systems.</li><li>Debugging & Emulation Tools: Proficient in using debugging tools and emulators such as QEMU to analyze embedded system behavior.</li><li>SBOM & Secure Update Protocols: Familiarity with SBOM (Software Bill of Materials), patch management, and secure update protocols to ensure safe software deployments.</li><li>Firmware Reverse Engineering: Expertise in performing reverse engineering of firmware images to detect vulnerabilities and potential exploits.</li><li>Penetration Testing Frameworks: Experience using penetration testing frameworks like Metasploit, Kali Linux, and custom tools for system vulnerability testing.</li><li>Custom Test Case Development: Ability to develop and execute custom test cases to simulate real-world attack scenarios and identify potential risks in embedded systems.</li><li>Leadership & Mentoring: Strong leadership skills with a proven track record of mentoring junior engineers and guiding teams in advanced security testing methodologies.</li><li>Technical Writing & Reporting: Excellent technical writing skills, including the ability to produce clear, concise, and detailed reports on security findings and risk assessments.</li><li>Proactive Security Risk Mitigation: Proactive in identifying and mitigating security risks within embedded systems, ensuring the implementation of security best practices.</li></ul><h3>Responsibilities:</h3><ul><li>Leadership in Security Testing: Lead system-level Vulnerability Assessment and Penetration Testing (VAPT) for firmware, operating systems, and embedded software, ensuring thorough security evaluations.</li><li>Test Plan Development & Execution: Develop and implement comprehensive test plans for secure update and patch validation, ensuring security fixes are applied correctly and without introducing new risks.</li><li>Firmware Static & Dynamic Analysis: Conduct detailed static and dynamic analysis of firmware images using tools like Ghidra, Binwalk, and Radare2 to identify potential vulnerabilities.</li><li>Secure Boot & Root of Trust Validation: Validate secure boot implementations and hardware root of trust to ensure system integrity and protection from malicious code injection.</li><li>OS Hardening & Access Control Testing: Test OS hardening configurations and secure access control mechanisms to strengthen system defenses against unauthorized access and exploitation.</li><li>Vulnerability Identification & Classification: Identify and classify vulnerabilities and misconfigurations in embedded systems, following industry standards such as CVSS for risk assessment and remediation prioritization.</li><li>Collaboration with Compliance & Engineering: Work closely with compliance and engineering teams to prioritize remediation efforts, ensuring that vulnerabilities are addressed effectively.</li><li>Custom Attack Simulations: Develop and execute custom test cases to simulate real-world attack scenarios and evaluate the system's resilience against cyber threats.</li><li>Rollback & Patch Management Testing: Oversee testing of rollback and patch management procedures, ensuring that system updates do not compromise security or functionality.</li><li>Mentoring & Knowledge Sharing: Mentor junior engineers in security testing methodologies, sharing knowledge on advanced techniques and tools for improving system security testing processes.</li><li>CVE Monitoring & Testing Updates: Monitor relevant CVE feeds, integrating new vulnerabilities and security patches into testing procedures to ensure up-to-date protection.</li><li>Reporting & Risk Assessments: Provide detailed technical reports and risk assessments to stakeholders, outlining identified vulnerabilities, potential impact, and recommended mitigations.</li><li>Regulatory Compliance: Ensure that all testing activities align with industry standards, including RED 18031 compliance, and adhere to relevant regulatory frameworks.</li><li>Secure Lab Environment Maintenance: Maintain a secure lab environment for all system testing activities, ensuring that testing procedures are conducted in a controlled and isolated setting.</li></ul><h3>Qualifications & Certifications:</h3><ul><li>Education: Bachelor's or Master’s degree in Cybersecurity, Embedded Systems, Computer Engineering, or a related field.</li><li>Certifications (Preferred):<ul><li>OSCP (Offensive Security Certified Professional)</li><li>OSCE (Offensive Security Certified Expert)</li><li>GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)</li><li>Equivalent certifications in ethical hacking, penetration testing, or embedded system security are also highly valued.</li></ul></li><li>Industry Standards Familiarity: Familiarity with security frameworks such as ISO/IEC 62443, RED 18031, and IoT security frameworks.</li></ul><h3>Why Join Us?</h3><ul><li>Opportunity to work with cutting-edge automation technologies in a collaborative and innovative environment.</li><li>Competitive salary and benefits package.</li><li>Career growth opportunities in a fast-paced and dynamic industry.</li><li>A strong focus on work-life balance and employee well-being.</li></ul><h1>Location:</h1>IN-GJ-Ahmedabad, India-Ognaj (eInfochips)<h1>Time Type:</h1>Full time<h1></h1><h1>Job Category:</h1>Engineering Services

Collected experience requirement

2 years