Embedded Security Consultant

Role overview Assess the security of embedded products by examining the device itself, its firmware, boot process, interfaces, and communications. The work combines hands-on hardware access with software analysis, tracing how product architecture and implementation affect security from device identity through backend connections.

Responsibilities - Assess boot chains, secure boot, firmware update flows, and readout protections. - Access and analyze devices through interfaces such as UART, JTAG, and SWD; extract and inspect flash or memory contents. - Unpack firmware and investigate filesystems, configuration, embedded secrets, and third-party components. - Analyze communications among devices, gateways, and backends, including proprietary protocols. - Evaluate how key storage and identity mechanisms are implemented and what protections they provide in context. - Produce security assessments that require understanding a product rather than applying a fixed checklist.

Requirements - Practical embedded Linux experience and firmware extraction, unpacking, and analysis skills. - Familiarity with ARM or AArch64 fundamentals, bootloaders, secure boot, and firmware updates. - Hands-on experience with UART, JTAG, or SWD, and flash or memory handling. - Ability to use Ghidra or IDA, write Python scripts, and perform basic protocol analysis.

Nice to have - RTOS, BLE, or other wireless technology experience. - Familiarity with secure elements, TPM, or TrustZone. - Experience with fuzzing, hardware debugging, exploitability analysis, memory corruption, or proprietary protocols.

Benefits and work setup - Permanent, remote-first position with flexible hours and occasional lab days in Mannheim; most device work can be done remotely. Invasive analysis takes place in the lab or at customer sites and is infrequent. - Access to a working hardware lab with devices, probes, and logic analyzers; time and budget for research, tools, publications, certifications, and conferences. - Senior-led technical reviews. The role also offers exposure to fault injection, decapsulation, side-channel evaluation, and coordinated disclosure.