Senior Engineer II - Product Security - AZ - Chandler, United States
Originally posted 8 August 2026 by the employer.
About the role
This role focuses on managing and addressing security vulnerabilities across Microchip's semiconductor product portfolio, development kits, firmware, software tools, and reference designs.
What you'll do
- Manage day-to-day intake, triage, and case management of product vulnerability reports.
- Perform technical vulnerability assessments and apply structured severity scoring (CVSS).
- Drive remediation coordination with Business Unit engineering teams and security champions.
- Author security advisories, bulletins, and customer communications in CSAF format.
- Execute CVE assignment and support CNA operations.
- Contribute to new regulations and standardization activities impacting product security, including EU Cyber Resilience Act, IEC 62443, ISO/SAE 21434, ETSI EN 303 645.
What you'll need
- Bachelor's degree in Electrical Engineering, Computer Engineering, Electrical and Computer Engineering, Computer Science, Embedded Systems, Cybersecurity, or a related engineering field.
- 7.5+ years of experience in firmware/embedded software development, product security engineering, or vulnerability management with focus on security in embedded systems.
- Experience in a PSIRT, Security Operations, or security incident response team environment.
- Experience with microcontroller/microprocessor platforms.
- Hands-on experience with cryptographic algorithm integration, hardware security module (HSM) drivers, security abstraction layers, secure key storage, PUF, or Trust Zone based isolation.
- Practical working knowledge of one or more product security standards: IEC 62443, ISO/SAE 21434, PSA Certified, SESIP, FIPS 140-3, Common Criteria, ETSI EN 303 645, NIST Cybersecurity Framework.
- Ability to analyze security vulnerabilities, assess exploitability, and apply structured scoring methodologies (CVSS).
- Familiarity with secure coding standards (MISRA-C, CERT C), static analysis, and development lifecycle standards (IEC 62443-4-1).
- Ability to author clear technical security documentation, compliance evidence, vulnerability assessments, and standards-aligned artifacts.
Nice to have
- CNA operations experience (CVE assignment).
- SBOM/VEX program experience (CycloneDX, SPDX, Black Duck, software composition analysis).
- Threat modeling familiarity (STRIDE, MITRE ATT&CK, EMB3D).
- Familiarity with EU Cyber Resilience Act, RED Delegated Act, NIS2, FDA premarket cybersecurity, or UN R155/R156.
- Coordinated vulnerability disclosure experience.
- Standards body participation or certification audit experience (IEC 62443, ISO 21434, Common Criteria, PSA Certified, FIPS evaluations).
Skills: product security, vulnerability management, PSIRT, embedded systems, cryptography
This role has been open 70 days — well above the 60-day median for Hardware Security Engineering roles.
Hardware Security Engineering · Hardware Security
|
Open roles in category
185
|
Median days open
60 d
|
Median salary
$224k
|
See the full market breakdown ▾Category comparison, skills in demand, and who else is hiring
| Metric | Microchip Technology | All employers we track in this specialty (185 roles · 46 employers) |
|---|---|---|
| Open roles in this specialty | 4 | 185 |
| Median days open | 70 d | 60 d (+10 d vs this employer) |
| Median salary (USD postings) | — | $224k |
Skills observed across this category: product security, vulnerability management, PSIRT, embedded systems, cryptography
Who's hiring in this category
- NVIDIA · 28 open roles · median 34 d
- NXP Semiconductors · 23 open roles · median 108 d
- Qualcomm · 17 open roles · median 122 d
- Arm Holdings · 13 open roles · median 102 d
- STMicroelectronics · 11 open roles · median 16 d
- AMD · 8 open roles · median 58 d
How we counted: 185 open Hardware Security Engineering (Hardware Security) roles from 46 employers tracked in the SemiconductorJobs index, counted 18 Oct 2026. Specialty figures count only roles carrying this exact specialty label, so an employer's related work in neighbouring specialties is not included there. Figures refresh nightly.