Staff Product Security Engineer

Sandisk s Product Security Engineering & Assurance (PSEA) organization is seeking a highly motivated Product Security Engineer - Hardware/Firmware & Adversarial Security Engineering to strengthen the security of our storage products.

This is a hands-on technical security role combining product security engineering, embedded/firmware security, and adversarial security engineering. The engineer will work closely with firmware, hardware, Platform Security, validation, and product teams to identify attack paths, evaluate security controls, validate vulnerabilities, and drive practical security improvements.

The role will also help develop AI-assisted and agentic security engineering capabilities that combine LLMs, security tools, automation, and human expertise to improve the scale and depth of product security analysis.

Key Responsibilities

Product & Firmware Security

• Assess hardware and firmware architectures from both defensive and attacker perspectives.
• Perform threat modeling and security risk assessments across embedded-system architectures.
• Evaluate security mechanisms including secure boot, roots of trust, firmware update and recovery, cryptography and key management, authentication, anti-rollback, provisioning, lifecycle controls, and debug/manufacturing interfaces.
• Identify attack paths and control gaps and work with engineering teams to develop practical mitigations.
• Support security readiness assessments and review security evidence including static analysis, SBOM/dependency analysis, fuzzing, penetration testing, and security validation results.

Adversarial Security Engineering

• Perform hands-on adversarial assessments of firmware and embedded products.
• Conduct firmware extraction, binary analysis, reverse engineering, vulnerability research, fuzzing, and runtime analysis.
• Analyze boot flows, firmware update mechanisms, trust boundaries, device interfaces, and security-critical components.
• Develop and validate attack hypotheses and proof-of-concept techniques to determine realistic exploitability.
• Analyze interfaces such as JTAG, UART, SPI, PCIe, and NVMe where applicable.
• Correlate findings across static analysis, reverse engineering, fuzzing, runtime analysis, and architecture review to identify multi-stage attack chains.
• Develop reusable adversarial testing tools, automation, and security playbooks.

AI-Assisted & Agentic Security Engineering

• Develop AI-assisted workflows for firmware analysis, threat modeling, vulnerability discovery, fuzzing, and security triage.
• Integrate LLMs with security tools, APIs, scripts, and analysis systems to automate security engineering workflows.
• Develop agentic workflows capable of invoking tools, analyzing results, developing attack hypotheses, and recommending subsequent testing.
• Ensure AI-generated security findings are validated through reproducible technical testing and appropriate human review.

PSIRT & Vulnerability Management

• Support PSIRT activities including vulnerability triage, technical investigation, CVSS assessment, remediation, and coordinated vulnerability response.
• Reproduce and validate externally reported or internally discovered vulnerabilities.
• Translate vulnerability findings into durable improvements to product architecture and development practices. Qualifications

Required

• Bachelor s degree or greater in Computer Science, Electrical Engineering, Computer Engineering, Cybersecurity, or a related technical field.
• 5+ years of experience in product security, embedded systems, firmware engineering, vulnerability research, offensive security, or related disciplines.
• Strong understanding of embedded and firmware security, secure boot, roots of trust, firmware updates, cryptography, authentication, threat modeling, and vulnerability analysis.
• Hands-on programming or scripting experience with Python, C/C++, or comparable languages.
• Experience with security testing, debugging, reverse engineering, static analysis, fuzzing, or vulnerability analysis.
• Ability to analyze complex systems with an attacker mindset and identify how security controls could be bypassed, chained, or abused.
• Strong technical communication, analytical, and problem-solving skills.

Preferred

• Experience with SSDs, NAND Flash, NVMe, PCIe, or embedded storage architectures.
• Embedded hardware/software development or firmware engineering experience.
• Experience with reverse-engineering tools such as Ghidra, IDA Pro, Binary Ninja, binwalk, or radare2.
• Experience with fuzzing technologies such as AFL++, libFuzzer, boofuzz, or equivalent frameworks.
• Experience with dynamic analysis, debugging, or emulation using GDB, QEMU, Frida, JTAG, or similar technologies.
• Experience developing security automation or reusable adversarial testing frameworks.
• Experience using LLMs for security engineering, vulnerability research, code/firmware analysis, or security automation.
• Familiarity with agentic AI/orchestration technologies such as LangGraph, LangChain, CrewAI, MCP, or equivalent frameworks.
• Familiarity with FIPS 140, Common Criteria, CVSS, PSIRT, penetration testing, and vulnerability management.

The successful candidate does not need experience with every technology listed above. We are looking for someone with strong embedded/firmware security fundamentals, an attacker mindset, hands-on engineering ability, and an interest in applying emerging AI capabilities to adversarial product security.