[Hiring] Product Security & Compliance Engineer @Nabu Casa

Role Description

Nabu Casa is looking for a full-time Product Security & Compliance Engineer to help ensure that our connected hardware and cloud services are secure, resilient, and compliant with the regulatory requirements that apply to them.

This is a deliberately hybrid role combining hands-on product security engineering with cybersecurity compliance. You will work across connected devices, firmware, networking, and cloud services:

• Building threat models
• Performing security validation
• Managing vulnerability and software-supply-chain risks
• Turning technical work into evidence required for product conformity

You will also help Nabu Casa navigate evolving product cybersecurity requirements such as the EU Radio Equipment Directive (RED), EN 18031, and the Cyber Resilience Act (CRA).

We are looking for someone with strong technical security foundations who is comfortable learning, interpreting requirements, taking ownership, and working across engineering and compliance boundaries.

Qualifications

• Strong hands-on technical experience in at least one of the following areas: embedded/firmware security, network security, application security, or cloud security.
• Experience creating architecture or data-flow diagrams and performing threat modeling for real products or systems.
• Practical experience with security testing and tooling, such as vulnerability scanning, SAST/DAST, software composition analysis, SBOM tooling, network security testing, firmware analysis, or penetration testing.
• Experience working with connected products, IoT, embedded systems, firmware, or systems that combine hardware and software/cloud services.
• Experience translating technical security findings into structured documentation, evidence, risk assessments, or compliance requirements.
• Knowledge of product cybersecurity standards or regulations, such as EN 18031, RED cybersecurity requirements, the Cyber Resilience Act, ETSI EN 303 645, IEC 62443, or comparable frameworks.
• Ability to independently interpret technical requirements, identify gaps, and work with engineering teams to implement appropriate solutions.
• Comfortable working autonomously across multiple technical domains in a distributed organization.
• Strong written and verbal communication skills.
• Fluent in English, both written and spoken.

Requirements

• Own the cybersecurity aspects of regulatory compliance for Nabu Casa's connected hardware products, including RED cybersecurity requirements and EN 18031.
• Help prepare Nabu Casa's products and processes for the EU Cyber Resilience Act (CRA), including vulnerability handling, security updates, SBOMs, support periods, and incident reporting.
• Create and maintain architecture and data-flow diagrams for connected products and services.
• Perform threat modeling and translate identified risks into security requirements and controls.
• Perform hands-on product security validation, including vulnerability and dependency scanning, SAST/DAST, firmware analysis, network and service exposure assessment, and targeted penetration testing.
• Generate and maintain Software Bills of Materials (SBOMs) and help monitor software dependencies for known vulnerabilities.
• Validate security mechanisms such as authentication, secure boot, and signed software or firmware updates.
• Translate security assessments and test results into structured compliance evidence, technical documentation, conformity assessments, and Declarations of Conformity.
• Work closely with hardware, firmware, cloud, and product teams to ensure security and compliance requirements are considered early in product development.
• Coordinate with our ODMs and external certification bodies where required, while owning Nabu Casa's cybersecurity evidence internally.
• Work with the Open Home Foundation to ensure security information, vulnerability handling, and software-related documentation flow effectively between open-source projects and Nabu Casa's commercial products.
• Keep track of product conformity status, security support periods, regulatory deadlines, and changes that may require reassessment.
• Provide privacy-by-design input for significant changes to our cloud services when needed.

Benefits

• Fully remote organization with flexible work hours.
• Five weeks (twenty-five days) of paid time off.
• Fourteen days of paid sick leave if your country/laws treat them as unpaid.
• Six weeks of paid and six weeks of unpaid parental leave to be used in the first year after birth.
• A budget for your work hardware once you start.
• An annual smart home budget to ensure you keep up-to-date with the latest smart home offerings.
• A 50% contribution to your internet connection fee at your home workspace.
• One day every two weeks to work on your personal projects.
• When first offering a position, Nabu Casa aims to provide a total compensation package that matches the 75th percentile for the new hire's role, seniority, and local market rates.