Fluidra
Website:
fluidra.com
Job details:
Role : Device Security / IOT Security Engineer
Role Overview
As a Senior IoT & Device Security Engineer, you will be Fluidra's hands-on technical expert for the security of connected devices — from silicon and firmware through to the cloud and mobile applications that control them. You will perform in-depth device penetration testing, embedded and firmware security assessments, and firmware fuzzing across Fluidra's IoT product portfolio. You will act as the key technical liaison between internal development teams and external hardware/firmware vendors, ensuring security is embedded from design through to production.
Key Responsibilities
Device & Hardware Penetration Testing
- Perform hands-on penetration testing of IoT devices, connected pool controllers, and smart wellness hardware, including hardware interfaces (UART, JTAG, SWD, SPI, I2C).
- Conduct side-channel, fault-injection, and physical tamper assessments where applicable to product risk profiles.
- Reverse engineer device firmware and hardware designs to identify exploitable vulnerabilities.
- Produce detailed technical findings, proof-of-concept exploits, risk ratings, and actionable remediation guidance.
Firmware & Embedded Security
- Perform static and dynamic firmware security analysis, including extraction, unpacking, and reverse engineering of embedded firmware images.
- Design and run firmware fuzzing campaigns against device interfaces, parsers, and communication stacks to uncover memory-safety and logic flaws.
- Review bootloader security, secure boot, firmware signing, and over-the-air (OTA) update mechanisms.
- Assess embedded operating systems, RTOS configurations, and chipset-level security controls in collaboration with hardware teams.
IoT Protocols & Cloud/Mobile Integration
- Assess security of IoT communication protocols (MQTT, CoAP, BLE, Zigbee, Z-Wave, Wi-Fi provisioning) used across the device portfolio.
- Review device authentication, pairing, and provisioning flows between devices, gateways, and Fluidra's cloud platforms.
- Evaluate the security of cloud-to-device and device-to-cloud communication channels, APIs, and message brokers.
- Assess companion mobile applications (iOS / Android) that interface with connected devices, including reviewing Objective-C and Swift codebases for iOS apps.
Vendor & Cross-Team Collaboration
- Act as the primary technical point of contact between Fluidra's product security team and external hardware/firmware/ODM vendors conducting or supporting device security work.
- Define device security requirements, test plans, and acceptance criteria to be shared with vendors ahead of engagements.
- Translate vendor penetration test reports and findings into clear, actionable guidance for internal firmware, hardware, and cloud engineering teams.
- Track vendor-identified and internally identified vulnerabilities through to remediation and verification.
Vulnerability Management & Program Support
- Triage, assess, and track device and firmware security vulnerabilities identified across the IoT product portfolio.
- Coordinate remediation timelines with firmware, hardware, and cloud engineering teams, and verify fixes.
- Contribute to secure design guidelines and threat models for new connected product lines.
- Stay current with IoT/embedded CVEs, exploit research, and emerging attack techniques relevant to Fluidra's device ecosystem.
Required Qualifications
- 5+ years of hands-on experience in IoT security, embedded security, or device/hardware penetration testing.
- Strong understanding of IoT technology, architecture, and connected device ecosystems.
- Practical experience with firmware security assessment, including firmware extraction, static analysis, and reverse engineering (e.g., Ghidra, IDA Pro, Binwalk).
- Hands-on experience with firmware fuzzing tools and techniques (e.g., AFL/AFL++, libFuzzer, boofuzz, Peach Fuzzer).
- Working knowledge of Objective-C (and ideally Swift) for reviewing and assessing iOS companion applications.
- Solid understanding of IoT communication protocols (MQTT, CoAP, BLE, Zigbee, Z-Wave) and their common security pitfalls.
- Experience assessing how IoT devices integrate with cloud platforms and mobile applications end-to-end.
- Familiarity with embedded systems and firmware development concepts for microcontrollers and embedded Linux platforms.
- Proven ability to work directly with hardware/firmware vendors, translating technical findings between vendors and internal teams.
- Excellent written and verbal communication skills; ability to explain complex device security risks to both technical and non-technical stakeholders.
Preferred Qualifications
- Experience with hardware tools such as logic analyzers, JTAG/SWD debuggers, chip-off techniques, and RF/SDR analysis.
- Familiarity with cloud security fundamentals (AWS) as they relate to device-to-cloud data flows.
- Mobile application security experience on both iOS and Android platforms.
- Relevant certifications such as OSCP, GPEN, GICSP, CEH, or an IoT/embedded-security-focused credential.
- Experience working in a regulated or compliance-driven environment (e.g., IEC 62443, CRA, ETSI EN 303 645).
- Prior experience in a product company with connected hardware/software products.
Why Join Fluidra?
- Be the hands-on device security expert for a global portfolio of connected products used by millions of customers worldwide.
- Work at the forefront of IoT, firmware, and embedded security in a fast-growing, innovation-driven company.
- Direct exposure across the full stack — silicon, firmware, cloud, and mobile — and to the vendors that build it.
- Collaborative, inclusive culture with opportunities for professional growth and development.
- Competitive compensation, flexible hybrid work model, and a strong commitment to work-life balance.
- Contribute to Fluidra's mission of creating a safer, smarter, and more sustainable pool and wellness experience.
Click on Apply to know more.
