Senior Product Security Assessor

We are Generac, a leading energy technology company committed to powering a smarter world.

Over the 60 plus years of Generac’s history, we’ve been dedicated to energy innovation. From creating the home standby generator market category, to our current evolution into an energy technology solutions company, we continue to push new boundaries.

Major Responsibilities

• Conduct end-to-end product security assessments for cloud services, backend systems, DevSecOps pipelines, and IoT devices against defined security requirements.
• Evaluate security controls across application, infrastructure, device, and pipeline layers to identify gaps, weaknesses, and non-conformances.
• Perform assessments aligned to IEC 62443 and internal Generac product security standards.
• Clearly document assessment scope, findings, compliance status, and overall security posture. Perform structured threat modeling for identified findings and architectural designs across cloud, device, and DevSecOps domains.
• Assess risk severity and potential impact, considering exploitability, exposure, and business context.
• Translate technical findings into clear risk statements that engineering and product teams can act upon.
• Assess backend cloud architectures, including containerized workloads and orchestrated environments, for secure configuration, network segmentation, identity controls, and data protection. Review container security practices such as image scanning, runtime protections, and least-privilege configurations.
• Evaluate cloud logging, monitoring, and incident detection capabilities to ensure adequate security observability.
• Assess CI and CD pipelines to ensure security controls are integrated and consistently applied. Review use of SAST, DAST, SCA, and infrastructure-as-code scanning within development workflows.
• Evaluate secrets management, key handling, and signing processes used in build and release pipelines.
• Identify gaps in automation, enforcement, or visibility that could introduce security risk.
• Conduct IoT device security assessments covering hardware, firmware, and embedded software. Evaluate secure boot, firmware signing, credential storage, encryption, and update mechanisms. Assess protections against physical tampering, reverse engineering, and unauthorized firmware modification.
• Review device compliance against IEC 62443-based device security requirements.
• Produce clear, structured assessment reports that document findings, risk ratings, and compliance gaps.
• Provide prioritized, risk-informed remediation recommendations that are practical and actionable. Support engineering teams by clarifying findings, answering technical questions, and validating remediation evidence.
• Execute assessments in alignment with defined Product Security engagement models and timelines.
• Participate in regular checkpoints, status updates, and structured feedback sessions
• Ensure consistency and quality across assessments through standardized templates and methodologies.

Minimum Job Requirements

Education

• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related technical field. Equivalent practical experience is also valued.

Work Experience

• 5+ years of experience in product security, cloud security, DevSecOps, or IoT security roles.
• 5+ years of IT audit experience

Knowledge / Skills / Abilities

• Working knowledge of embedded systems, firmware security, and IoT security principles.
• Mastery of security standards and frameworks such as IEC 62443, ISO 27001, and NIST 800-53.
• Ability to produce clear, concise, and high-quality security assessment documentation.
• Clear communicator who can work across engineering, product, and security stakeholders.
• The ability to manage up to 10 concurrent, complex audits.
• Hands-on experience performing threat modeling, vulnerability assessments, and security reviews.
• Strong understanding of backend cloud architectures, container platforms, and CI and CD pipelines.

Preferred Job Requirements

Education

• Bachelor’s or Master’s degree in Computer Science, Engineering, Cybersecurity, Information Security, or a related technical discipline.

Certification / License

• Certifications such as CISSP, CCSP, CSSLP, or cloud security certifications are helpful but not required.

Work Experience

• Experience with IEC 62443 compliance assessments or similar industrial cybersecurity standards in production environments.
• Experience conducting security assessments of IoT or embedded devices, including firmware analysis and hardware security evaluation.
• Familiarity with DevSecOps tooling such as SAST, DAST, SCA, and infrastructure-as-code scanning platforms.
• Experience with cloud security posture management in AWS, Azure, or GCP environments.

Knowledge / Skills / Abilities

• Ability to balance thoroughness of assessment with speed of delivery, and to convert complex technical findings into practical, actionable remediation guidance for engineering teams.

Physical Requirements and Working Conditions

PHYSICAL DEMANDS:

Office Environment: While performing the duties of this job, the employee is regularly required to talk and hear and use hands to operate a computer and standard office equipment. The employee is regularly required to sit, stand, and walk. Specific conditions of this job are typical of frequent and continuous computer based work requiring periods of sitting, close vision, and the ability to adjust focus. Occasional travel may be required. This role is primarily office based and does not generally require shop floor or field technician physical demands.

DISCLAIMER

All responsibilities and requirements are subject to possible modification to reasonably accommodate individuals with disabilities.

This job description does not state or imply that these are the only responsibilities to be performed by an employee in this role. Employees must follow any other job related instructions and perform any other job related duties requested by their leaders.