Product Security & Compliance Engineer
Nabu Casa · Remote · Europe - Anywhere · Greece · Belgium · Eslovenia · Latvia · Bulgaria · Italy · Lithuania · Poland · United Kingdom · Ireland · Romania · Portugal · Hungary · Spain · Netherlands ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Fully remote worldwide
- IoT security focus
- EU compliance expertise
- Flexible schedule
- Open source backed
Join Nabu Casa, the company behind Home Assistant Cloud, to ensure product security and regulatory compliance. You will work across firmware, networking, and cloud services to build threat models, validate security, and manage compliance with standards like the EU Cyber Resilience Act.
This hybrid role requires translating technical security work into evidence for product conformity. You will collaborate with hardware and software teams to embed security early in development while navigating evolving cybersecurity requirements.
What you'll do
- Own cybersecurity aspects of regulatory compliance for connected hardware
- Prepare products for EU Cyber Resilience Act and RED requirements
- Create architecture diagrams and perform threat modeling
- Conduct vulnerability scanning, SAST/DAST, and firmware analysis
- Generate Software Bills of Materials and monitor dependencies
- Validate secure boot, authentication, and signed updates
- Translate security assessments into compliance evidence
- Coordinate with ODMs and external certification bodies
What you'll need
- Strong experience in embedded, network, app, or cloud security
- Proficiency in creating data-flow diagrams and threat modeling
- Practical skills with security testing tools and SBOM generation
- Experience with IoT, embedded systems, or hybrid hardware/software
- Ability to translate technical findings into compliance documentation
- Knowledge of standards like EN 18031, RED, or CRA
- Fluent in English, both written and spoken
- Comfortable working autonomously in a distributed team
Nice to have
- Personal experience with Home Assistant ecosystem
- Experience with CE/RED conformity or FCC authorization
- Direct knowledge of EN 18031 and RED Article 3.3
- Familiarity with ETSI EN 303 645 or IEC 62443
- Experience with secure boot and signed OTA updates
- Integration of security testing into CI/CD pipelines
- Relevant certifications like OSCP, CISSP, or CIPP/E
Stack
- Home Assistant
- SAST/DAST tools
- SBOM tooling
- Firmware analysis tools
- Vulnerability scanners
How you'll work
- Fully remote organization
- 40 hours per week
- No fixed schedule
- 3 hours daily overlap required
- Employed via Remote.com
What you get
- 25 days paid time off
- 14 days paid sick leave
- 6 weeks paid parental leave
- Work hardware budget
- Annual smart home budget
- 50% internet contribution
- Bi-weekly personal project day
Hiring process
- Application review
- HR screening (30 mins)
- Technical case
- Team interview
- Final interview with Founder
- Offer