Product Security Engineer II

Schneider Electric is seeking a Product Security Engineer II to serve as the dedicated security subject matter expert for its on-premises DCIM software. In this onsite role in Andover, MA, you will support the Secure Development Lifecycle by identifying, assessing, and driving resolution of product security risks across the full release lifecycle.

You will work at the intersection of vulnerability management, security testing and disclosure, secure development, and supply chain hardening, partnering closely with engineering, product, and security stakeholders to strengthen both the product and customer security posture.

Core Responsibilities

• Triaging vulnerability reports from tools and sources including Snyk, Dependabot, container scanning, and Nessus, as well as internal security teams, external researchers, and testing firms.
• Assessing exploitability and severity using CVSS 3.1 and CVSS 4.0, then driving findings through to resolution.
• Coordinating internal and external penetration testing and programs such as CyTRICS.
• Reproducing and validating findings, verifying fixes, and partnering with PSIRT on coordinated vulnerability disclosure and customer security notifications.
• Leading security reviews for product releases, collecting security evidence and artifacts, and working through release approval with the product security organization.
• Maintaining risk assessments, threat models, security documentation, and customer security information.
• Supporting requirements tied to cybersecurity regulations, including the EU Cyber Resilience Act (CRA).
• Reviewing designs and code for vulnerabilities related to authentication, authorization, SSRF, XXE, path traversal, session management, security logging, and secrets management.
• Guiding or implementing remediation and developing negative security tests.
• Maintaining comprehensive SBOMs for released products.
• Partnering with DevOps to ensure effective security scanning in build pipelines, supporting release and package signing, and defining security hardening requirements for appliances and customer-managed Linux environments.

Required Qualifications

• 7+ years of experience in software engineering or cybersecurity, including 3+ years in product or application security.
• Ability to review Java/Spring, TypeScript, and Linux configurations to investigate and validate security findings.
• Hands-on experience with SCA and vulnerability scanning tools, with working knowledge of CVSS, CWE, and the OWASP Top 10.
• Working knowledge of IEC 62443-4-1/4-2, NIST SSDF, or comparable secure development standards.
• Knowledge of applied cryptography including FIPS 140-3 modes, PKI/TLS, LDAP, SAML, OAuth2, and container/Kubernetes security, plus SBOM formats such as CycloneDX or SPDX.
• Experience triaging externally reported vulnerabilities and supporting coordinated vulnerability disclosure.
• Strong communication skills with developers, product managers, Legal, customers, security researchers, and external testing organizations.

Technologies

• Snyk, Dependabot, Nessus, CyTRICS, PSIRT, CVSS 3.1, CVSS 4.0
• Java/Spring, TypeScript, Linux, SCA, CWE, OWASP Top 10
• IEC 62443-4-1/4-2, NIST SSDF, FIPS 140-3, PKI/TLS, LDAP, SAML, OAuth2
• container/Kubernetes, CycloneDX, SPDX, SBOM, DevOps
• SSRF, XXE, path traversal, session management, security logging, secrets management

Location and Compensation

• Location: Andover, MA (onsite)
• Salary: USD 117,600 - 176,400 per year

Benefits

• Medical (with member reward points), dental, vision, and basic life insurance
• Benefit Bucks
• Flexible work arrangements
• Paid family leaves
• Well-being programs
• 12 holidays per year
• 15 days of paid time off per year
• 401(k) with match
• Company share ownership
• Performance discussions and global opportunities
• Learning platforms like Coursera
• Volunteer leave and programs with the Schneider Electric Foundation
• Youth education initiatives
• Military leave benefits

Preferred Qualifications

• Experience with cybersecurity legislation or regulation, including the EU Cyber Resilience Act
• Experience managing penetration testing or external security-testing programs such as CyTRICS
• Ability to implement security fixes in Java/Spring or TypeScript
• Experience using AI-assisted tools for secure code review or vulnerability discovery
• Relevant security certification such as GIAC GWEB, OSWE, CKS, or CSSLP