DescriptionPlease note that the salary range referenced is a general guideline only. Salary differentials are based on multiple factors including (but not limited to), geographic location, education/training, years of relevant experience/seniority, merit, qualifications, as well as market and business considerations. Mitsubishi Electric Iconics Digital Solutions considers all of these variables when extending an offer of employment.
Position Overview
The Product Security Researcher is a technical product security role responsible for investigating vulnerabilities, supporting vulnerability disclosure, improving product security assurance, and providing technical evidence for cybersecurity compliance.
As a member of the Product Security team, this role will work closely with the Product Security Incident Response Team (PSIRT), Engineering, and QA to analyze security findings, reproduce vulnerabilities, develop proof-of-concept tests, validate remediation, prepare draft advisories, and support compliance with the EU Cyber Resilience Act (CRA) and IEC 62443-4-1 / 4-2.
Key Responsibilities
1. Vulnerability Research & PSIRT Support
- Review, triage, reproduce, and investigate product vulnerability reports.
- Determine affected products, exploitability, severity, and technical impact.
- Analyze CVEs and vulnerabilities affecting third-party and open-source components.
- Work with Engineering and QA on root-cause analysis, security tests, remediation, and fix validation.
- Support CVSS scoring and preparation of security advisories, CVE information, VEX statements, and customer communications.
- Maintain technical evidence supporting vulnerability and disclosure decisions.
2. Product Security Assurance
- Review findings from SAST, SCA, DAST, vulnerability scanners, SBOM analysis, and penetration testing.
- Investigate potential false positives and determine whether findings are applicable or exploitable.
- Develop security tests and work with QA to incorporate appropriate tests into regression testing.
- Support security testing and assessment of third-party components.
- Use approved AI tools to assist vulnerability analysis, research, and test development while independently validating conclusions.
- Identify recurring security weaknesses and recommend improvements to development and testing practices.
3. Compliance Technical Support
- Perform technical gap analysis and provide supporting evidence for EU CRA compliance.
- Contribute security-related content and evidence for CRA technical documentation and conformity-assessment activities.
- Support IEC 62443-4-1 and IEC 62443-4-2 assessments, evidence collection, and remediation activities.
- Coordinate technical evidence and responses for internal and external security audits.
- Maintain traceability between security requirements, product implementation, testing, vulnerabilities, and supporting evidence.
Required Qualifications/Certifications
Education & Experience
- 5+ years of relevant experience, or a related bachelor's degree and 2+ years of relevant experience.
- Experience in product security, vulnerability research, application security, penetration testing, PSIRT, or security testing.
- Strong understanding of common software vulnerabilities, exploitation concepts, CVE/CWE, and CVSS.
- Experience reproducing vulnerabilities and analyzing third-party component vulnerabilities.
- Ability to develop security tests or scripts using Python, PowerShell, Bash, C/C++, C#, or similar languages.
- Familiarity with security-testing, debugging, vulnerability-scanning, and software-composition-analysis tools.
- Strong technical writing and communication skills.
- Ability to collaborate effectively with Engineering, QA, Product Security, and other stakeholders.
Technical Skills
- Experience with coordinated vulnerability disclosure or PSIRT processes.
- Experience supporting security audits or product cybersecurity certification.
- Familiarity with threat modeling, penetration testing, SAST/SCA/DAST, and secure development lifecycle practices.
- Experience with ICS/OT, SCADA, HMI, or industrial automation products preferred.
- Knowledge of IEC 62443-4-1 / 4-2 and the EU Cyber Resilience Act preferred.
- Familiarity with SBOM, CycloneDX, SPDX, CSAF, and VEX preferred.
- Relevant certifications such as CSSLP, GICSP, CISSP, OSCP, GIAC, or IEC 62443 training/certification are beneficial.
Location & Travel- Hybrid role based in Foxborough, MA, with limited travel to the Cambridge office.
- Up to 5% travel may be required.
Benefits:
- 401(k) with company match and contribution
- Employee Assistance Program
- Health, dental, and vision insurance
- Flexible Spending Account
