Senior PSIRT Security Engineer, Embedded & Semiconductor Products (m/f/d)
NXP Semiconductors · Gratkorn
As a technical member of NXP’s Product Security Incident Response Team, you will analyze reported vulnerabilities affecting hardware, firmware, software, and embedded product platforms. You will work with product subject matter experts to reproduce issues, determine technical impact, identify affected configurations, assess exploitability, and develop technically sound mitigation or remediation recommendations.
What you'll do: A snapshot of your key responsibilities and impact.
- Perform technical triage of vulnerability reports affecting NXP hardware, firmware, software, development tools, and embedded platforms.
- Analyze vulnerability prerequisites, attack paths, trust boundaries, affected components, and potential customer impact.
- Work with product teams to reproduce reported behavior and validate findings.
- Determine affected product families, configurations, software versions, and customer usage scenarios.
- Assess exploitability and severity using available technical evidence and applicable scoring methodologies.
- Document the technical rationale supporting severity, scope, affected product, and remediation decisions.
- Provide technically precise content for CVE records, security advisories, customer communications, and researcher responses.
- Engage directly with security researchers to clarify findings, request evidence, and validate coordinated disclosure materials.
- Advise product teams on recurring vulnerability patterns and opportunities to improve product-security engineering.
- Act as a trusted advisor to product teams on vulnerability management and product security best practices.
- Continuously improve PSIRT processes, metrics, and operational excellence.
What you'll bring
- Experience in Product Security, Embedded Security, Semiconductor Security, Cybersecurity, or Secure Product Development.
- 3+ years of relevant work experience in a security related role
- Bachelor’s/master’s degree in engineering – Computer Science, Electrical Engineering, Cybersecurity, or a related field.
- Strong experience in embedded security, hardware security, semiconductor security, firmware security, product security, or vulnerability research.
- Working knowledge of embedded architectures, microcontrollers, microprocessors, secure elements, firmware, boot chains, hardware security features, and low-level software.
- Ability to analyze vulnerability reports and reason about attack prerequisites, privilege boundaries, exploitability, and product impact.
- Experience with one or more relevant technical areas such as C/C++, assembly, reverse engineering, firmware analysis, secure boot, cryptography, debug interfaces, hardware-assisted security, fault injection, or side-channel analysis.
- Familiarity with vulnerability classification, CVE, CVSS, CWE, coordinated disclosure, and security advisory development.
- Experience in automotive, industrial, IoT, mobile, secure identification, connectivity, or communication-infrastructure products is advantageous.
- Excellent collaboration and communication skills to work effectively with cross-functional teams.
- Fluent in English
Understand Threats. Protect Products. Protect Customers. Lead Response. Reduce Risk. Build Trust. Drive Security. Create Impact. Shape Tomorrow.
For Austrian applicants: NXP provides market competitive compensation according to the benchmarking of the electronic and semiconductor industry. Due to the Austrian Equal Treatment Act we are obligated to state the employment group of our applicable collective bargaining agreement (CBA) “Kollektivvertrag für Angestellte Gewerbe und Handwerk und in der Dienstleistung“, this position (fulltime) is graded in Employment Group V. Your individual experiences and expectations will be considered in the application process. Moreover, we provide attractive benefits to our employees like home office, flexible working time, meal benefits and more.
#LI-f5d0