Senior Security Software Engineer/Developer

Vecima Networks Inc.•,

About The Position

Vecima Networks is seeking a hands-on Senior Security Software Engineer/Developer to work directly with software and product engineering teams to design, build, test, release, and maintain secure products. The role partners with Software Architects, Developers, Product Management, and Compliance to identify security risks, improve product architectures, investigate vulnerabilities, and integrate practical security capabilities into the product development lifecycle. The position focuses on Product Security rather than Security Operations Centre work, corporate network administration, or general corporate IT security. Its scope includes secure software design, threat modelling, embedded Linux, vulnerability analysis, software supply-chain security, SBOMs, security automation, and product security assurance. The successful candidate will serve as an engineering partner, helping teams make sound security decisions and providing deeper technical expertise where needed. Customer interaction is an important part of the role. The engineer will explain Vecima’s Product Security approach, collaborate with service provider customers on evolving threats and security needs, and support security reviews and deployment practices. The role also leads the technical Product Security contribution to the organization’s ISO/IEC 27001 Information Security Management System.

Requirements

At least 5 years of professional software engineering, security engineering, or combined experience, including significant hands-on experience securing production software.
Experience with Linux, source control, code review, build systems, CI/CD, automated testing, and modern software development practices.
Ability to understand production software at source-code level and work effectively with developers on security-sensitive changes.
Programming ability in at least one relevant language, such as C, C++, Python, Go, Java, JavaScript/TypeScript, or Rust.
Experience applying Product Security or Application Security practices within a software development organization.
Strong understanding of secure software design, common vulnerability classes, attack techniques, and defensive controls.
Practical threat modelling experience using STRIDE, attack trees, abuse cases, or an equivalent risk-based approach.
Experience reviewing software or system architectures from a security perspective and translating risks into practical engineering requirements.
Experience investigating vulnerabilities and determining technical impact, exploitability, affected components, and appropriate mitigations.
Experience with SBOM and software composition analysis tools, and familiarity with CycloneDX.
Working knowledge of software dependencies, vulnerability databases, software supply-chain risk, and vulnerability remediation.
Understanding of how software is built, packaged, released, deployed, and maintained in production environments.
Ability to explain complex technical security risks clearly to developers, architects, product leaders, auditors, and customers.
Sound engineering judgment and ability to balance risk reduction with product constraints, delivery requirements, reliability, performance, and long-term maintainability.
Ability to lead through technical credibility, collaboration, coaching, and influence rather than organizational authority.
Comfort working across multiple engineering teams and helping them solve security problems without becoming a central approval bottleneck.
Comfort developing and leading customer presentations and collaborative technical engagement.

Nice To Haves

Embedded Linux or Linux-based product development.
Experience with networking products, telecommunications, distributed systems, or cloud-connected appliances.
Experience with secure boot, trusted execution, hardware-backed identity, cryptographic key management, signed software updates, or device lifecycle security.
Hands-on vulnerability reproduction and investigation experience.
Experience with static or dynamic application security testing, fuzzing, penetration testing, binary analysis, reverse engineering, or runtime security analysis.
Experience analysing vulnerable source code, attack paths, proof-of-concept behaviour, or security mitigations.
Familiarity with CycloneDX VEX, CSAF, SPDX, package URLs (purl), or CPE.
Familiarity with CVE, CVSS, CWE, CISA Known Exploited Vulnerabilities, vulnerability disclosure, or PSIRT processes.
Experience improving the accuracy, completeness, or operational use of SBOM and vulnerability data.
Experience with ISO/IEC 27001 controls and technical audit evidence in a product development environment.
Familiarity with secure development frameworks or standards such as NIST SSDF, OWASP SAMM, IEC 62443, or related regulatory requirements.
Experience improving a secure development programme across multiple products or engineering teams.
Relevant security or software certifications.

Responsibilities

Identify and reduce security risk throughout the product lifecycle, from early design through deployment, maintenance, and end of life.
Lead threat modelling for new products, features, and significant architecture changes, identifying assets, trust boundaries, attack surfaces, abuse cases, attack paths, and appropriate controls.
Review product architectures and security-sensitive designs, including authentication, authorization, identity, credential management, cryptography, secure communications, audit logging, update mechanisms, secure defaults, and safe failure behaviour.
Translate security risks into engineering requirements, implementation guidance, verification plans, and actionable development work.
Provide practical security leadership and coach developers and architects in secure design, secure coding, threat modelling, and security testing.
Improve secure product development through risk-based activities, release criteria, reusable guidance, templates, security reviews, and automated CI/CD checks.
Help teams apply defense in depth, least privilege, secure-by-default behaviour, and appropriate isolation boundaries across embedded software, Linux systems, distributed services, cloud-connected products, APIs, and management interfaces.
Support SBOM generation, validation, completeness, release integration, and disclosure using CycloneDX and related standards.
Monitor and triage CVEs; support product vulnerability assessment, remediation, disclosure, customer communication, and PSIRT practices.
Lead the technical Product Security contribution to the organization’s ISO/IEC 27001 ISMS, including applicable controls, procedures, and technical evidence.
Lead customer engagement related to security reviews, questionnaires, contractual requirements, and audits, providing clear technical evidence.
Develop and lead customer presentations and collaborative technical engagement about product security principles, integration with customer security infrastructure, and deployment and operation best practices.