Product & Application Security Engineer

Sungrow USA Corporation• US,

2h•$140,000 - $160,000•Remote

About The Position

Sungrow Americas is seeking a Product and Application Security Engineer to execute security across the full product ecosystem - spanning firmware, embedded systems, hardware-integrated applications, cloud services, and connected platforms. This role is responsible for deep technical security execution across the entire product lifecycle, ensuring that security is embedded from device to cloud to application layer. You will serve as the hands-on technical authority, working directly with engineering teams to identify, validate, and remediate vulnerabilities across software, firmware, hardware interfaces, and system integrations. This is a high-depth, cross-domain role, ideal for an engineer who can move fluidly between code, devices, protocols, and cloud architectures.

Requirements

6–10+ years of experience in product security, embedded security, application security, or IoT security.
Hands-on experience across multiple layers of the stack, including application security (OWASP, API security), firmware or embedded systems, and network protocols and device communications.
Strong ability to perform manual code review, firmware analysis (static/dynamic), and system-level threat analysis.
Experience with security tooling across SAST, DAST, SCA, firmware analysis, and network testing.
Working knowledge of modern architectures (cloud, microservices, device-cloud integration).
Ability to leverage Ai..

Nice To Haves

Experience with industrial systems, energy, or OT environments.
Familiarity with hardware security concepts (secure boot, TPM, hardware roots of trust).
Experience with reverse engineering or low-level debugging.
Exposure to SBOM/HBOM frameworks and supply chain security models (SLSA, etc.).
Certifications such as OSCP, OSCE, OSWE, GXPN, or similar.

Responsibilities

Perform security assessments across applications (web, APIs, backend services), firmware and embedded systems, hardware interfaces and device communications, and cloud-connected platforms and IoT ecosystems.
Conduct code review, firmware analysis, and system-level security testing.
Identify and validate vulnerabilities across the entire product attack surface.
Embed security into SDLC across software, firmware, and device-integrated systems.
Define and implement secure design patterns across application layers, device firmware, and communication protocols.
Partner with engineering to ensure secure-by-design architecture decisions.
Perform and support penetration testing, firmware analysis, and device-level assessments.
Validate findings from internal testing, third-party assessments, and teardowns.
Simulate real-world attack paths across device → network → cloud → application.
Triage and validate vulnerabilities across software, firmware, and hardware layers.
Provide clear, actionable remediation guidance tailored to engineering teams.
Track and drive remediation aligned to risk and customer impact.
Support SBOM/HBOM analysis and validation.
Identify risks in third-party libraries, firmware components, and hardware dependencies.
Assist in mitigation strategies across supplier-integrated components.
Evaluate security risks in IoT architectures and edge devices, cloud-native and distributed systems, and agentic / autonomous system behaviors (where applicable).
Help define guardrails for secure adoption of new technologies.
Act as a trusted technical partner to software, firmware, and hardware teams.
Translate security findings into practical engineering fixes.
Provide real-time guidance during development, not just post-testing.
Contribute to a culture of security ownership within engineering.
Experience leveraging AI/ML-assisted tools to improve security engineering outcomes, including code analysis and vulnerability detection, secure code generation and review validation, and automation of repetitive security testing and triage tasks.
Ability to integrate AI capabilities into engineering workflows, including API-based integrations with development and security tooling and automation of security processes within CI/CD pipelines.
Working understanding of security risks associated with AI-enabled systems, including prompt injection and model misuse, data exposure and model leakage risks, and secure handling of sensitive data in AI workflows.
Practical ability to build lightweight automation and tooling (scripts, integrations, or pipelines) to scale security operations.