Sbom Standards Cybersecurity Jobs

1 job found

Today

Product Security Engineer II

Schneider Electric Andover, MA

Andover, MA

Today

$118k - $176k/yr Full time Application Security Cybersecurity Tools Engineer

Apply Now

Job Description

Schneider Electric is seeking a Product Security Engineer II to serve as the dedicated security subject matter expert for its on-premises DCIM software. In this onsite role in Andover, MA, you will support the Secure Development Lifecycle by identifying, assessing, and driving resolution of product security risks across the full release lifecycle.

You will work at the intersection of vulnerability management, security testing and disclosure, secure development, and supply chain hardening, partnering closely with engineering, product, and security stakeholders to strengthen both the product and customer security posture.

Core Responsibilities

Triaging vulnerability reports from tools and sources including Snyk, Dependabot, container scanning, and Nessus, as well as internal security teams, external researchers, and testing firms.
Assessing exploitability and severity using CVSS 3.1 and CVSS 4.0, then driving findings through to resolution.
Coordinating internal and external penetration testing and programs such as CyTRICS.
Reproducing and validating findings, verifying fixes, and partnering with PSIRT on coordinated vulnerability disclosure and customer security notifications.
Leading security reviews for product releases, collecting security evidence and artifacts, and working through release approval with the product security organization.
Maintaining risk assessments, threat models, security documentation, and customer security information.
Supporting requirements tied to cybersecurity regulations, including the EU Cyber Resilience Act (CRA).
Reviewing designs and code for vulnerabilities related to authentication, authorization, SSRF, XXE, path traversal, session management, security logging, and secrets management.
Guiding or implementing remediation and developing negative security tests.
Maintaining comprehensive SBOMs for released products.
Partnering with DevOps to ensure effective security scanning in build pipelines, supporting release and package signing, and defining security hardening requirements for appliances and customer-managed Linux environments.

Required Qualifications

7+ years of experience in software engineering or cybersecurity, including 3+ years in product or application security.
Ability to review Java/Spring, TypeScript, and Linux configurations to investigate and validate security findings.
Hands-on experience with SCA and vulnerability scanning tools, with working knowledge of CVSS, CWE, and the OWASP Top 10.
Working knowledge of IEC 62443-4-1/4-2, NIST SSDF, or comparable secure development standards.
Knowledge of applied cryptography including FIPS 140-3 modes, PKI/TLS, LDAP, SAML, OAuth2, and container/Kubernetes security, plus SBOM formats such as CycloneDX or SPDX.
Experience triaging externally reported vulnerabilities and supporting coordinated vulnerability disclosure.
Strong communication skills with developers, product managers, Legal, customers, security researchers, and external testing organizations.

Technologies

Snyk, Dependabot, Nessus, CyTRICS, PSIRT, CVSS 3.1, CVSS 4.0
Java/Spring, TypeScript, Linux, SCA, CWE, OWASP Top 10
IEC 62443-4-1/4-2, NIST SSDF, FIPS 140-3, PKI/TLS, LDAP, SAML, OAuth2
container/Kubernetes, CycloneDX, SPDX, SBOM, DevOps
SSRF, XXE, path traversal, session management, security logging, secrets management

Location and Compensation

Location: Andover, MA (onsite)
Salary: USD 117,600 - 176,400 per year

Benefits

Medical (with member reward points), dental, vision, and basic life insurance
Benefit Bucks
Flexible work arrangements
Paid family leaves
Well-being programs
12 holidays per year
15 days of paid time off per year
401(k) with match
Company share ownership
Performance discussions and global opportunities
Learning platforms like Coursera
Volunteer leave and programs with the Schneider Electric Foundation
Youth education initiatives
Military leave benefits

Preferred Qualifications

Experience with cybersecurity legislation or regulation, including the EU Cyber Resilience Act
Experience managing penetration testing or external security-testing programs such as CyTRICS
Ability to implement security fixes in Java/Spring or TypeScript
Experience using AI-assisted tools for secure code review or vulnerability discovery
Relevant security certification such as GIAC GWEB, OSWE, CKS, or CSSLP

View full job page →

Get Sbom Standards Cybersecurity Jobs alerts

New Sbom Standards Cybersecurity Jobs, daily.