Embedded Developer (Product Security & IoT)

Quick Facts

• Role: Embedded Developer (Product Security & IoT)

• Work mode: Remote

• Engagement: B2B / Contract

• Commitment: 100%

• Start: Oct/Nov 2026

• Project duration: 12–24 months

• Language: English

Description

You will join an in-house team to adapt an existing embedded product to Cyber Resilience Act (CRA) requirements ahead of 2027 regulatory deadlines. This is a hands-on role combining embedded development and product security—*not* compliance/audit-only documentation work. You’ll work with a large, long-term codebase to develop and secure the product.

Responsibilities

• Implement secure-by-design and secure-by-default practices in firmware

• Develop authentication, access control, and data encryption for data at rest and in transit

• Reduce the device attack surface

• Implement a secure firmware delivery process, including signing and authenticating updates

• Build secure automatic updates with opt-out and rollback to a known safe version

• Implement device identity management using PKI and integrate with a commercial signing platform

• Implement security event logging and monitoring

• Ensure secure data deletion when devices are decommissioned

• Implement machine-readable SBOM and integrate SBOM tools into the build process

• Improve vulnerability triage and remediation processes to deliver security fixes independently of functional changes where possible

• Use AI tools to analyze large/unknown codebases, track data flows, and identify risky areas

• Create AI-assisted team workflows

• Prepare required technical documentation (e.g., architecture, links to risk assessment, SBOM references)

Benefits

• Remote work

• Full-time B2B/contract engagement for 12–24 months

• Opportunity to deliver hands-on product security improvements in an embedded/IoT environment