Senior Security Engineer

Job description
We are seeking a Senior Security Engineer with expertise in networking, secure communication applications, and devices. The ideal candidate has hands-on experience in the security assessments of thick client applications, mobile applications, Windows, macOS, iOS, Android, and embedded Linux systems. In this role, you will conduct threat modeling, security assessments, vulnerability assessments, and penetration testing of communication systems, working closely with architecture and development teams to ensure the security of the end product. Hands-on expertise with secure protocols, encryption, platform security, and embedded systems will be utilized daily to perform security design reviews, threat modeling, and testing for network encryptors, secure communication devices, and associated applications. This role involves performing security validation using SAST, SCA, DAST, and fuzzing techniques to identify vulnerabilities in both hardware and software implementations.

Responsibilities:
• Conduct architecture security reviews and threat modeling for secure communication solutions, like network encryptors or phones.
• Perform security testing of various secure communication solutions.
• Perform security assessments of low-level components, like the MCU or firmware.
• Ensure that software dependencies are up-to-date and that vulnerabilities are reported promptly.
• Execute protocol and binary fuzzing to uncover vulnerabilities in custom or proprietary implementations.
• Utilize SAST, SCA, and DAST tools to integrate security into the entire SSDLC.
• Work closely with development teams to embed secure coding practices and security automation.
• Assess and review cryptographic implementations for weaknesses or deviations from standards.

Requirements:
• Understanding of Rust, C, Go, and Python code.
• Hands-on experience with network security, including protocol analysis, packet inspection, and secure communications.
• Expertise in mobile security tools such as Frida, Hopper, IDA Pro, Ghidra, and other reverse engineering techniques for mobile applications.
• In-depth knowledge of containerization technologies (Docker, Kubernetes) and cloud-native security best practices.
• Proficiency in fuzzing techniques for network protocols and binaries.
• Deep understanding of secure design principles, SSDLC methodologies, and security testing processes.
• Strong analytical skills with the ability to document findings and recommendations in a structured manner.
• Experience in organizations with mature security processes and structured workflows.
• Proven experience with security assessments, penetration testing, and vulnerability management across multiple platforms.
• Experience in security assessments of cryptographic protocols and implementations.
• Knowledge of secure communication devices, HSMs, and encryption modules.
• Strong understanding of secure communication protocols (TLS, IPsec, etc. ).
• Familiarity with security compliance frameworks and industry standards (e. g., NIST, ISO 2700,1 Common Criteria, FIPS 140-2/3).
• Prior exposure to security in embedded systems or hardware-based cryptography.
• Experience with SAST, SCA, and DAST tools (e. g., Coverity, BlackDuck, Burp).
• Deep understanding of secure design principles, SSDLC methodologies, and security testing processes.
• Strong analytical skills with the ability to document findings and recommendations in a structured manner.
• Experience in organizations with mature security processes and structured workflows.
• Experience securing mobile operating systems and mobile device management (MDM) solutions.
• Experience securing cloud platforms such as AWS, GCP, or Azure, and familiarity with securing cloud-native communication applications.