Staff Product Security Engineer

Sandisk’s Product Security Engineering & Assurance (PSEA) organization is seeking a highly motivated Product Security Engineer – Hardware/Firmware & Adversarial Security Engineering to strengthen the security of our storage products.

This is a hands-on technical security role combining product security engineering, embedded/firmware security, and adversarial security engineering. The engineer will work closely with firmware, hardware, Platform Security, validation, and product teams to identify attack paths, evaluate security controls, validate vulnerabilities, and drive practical security improvements.

The role will also help develop AI-assisted and agentic security engineering capabilities that combine LLMs, security tools, automation, and human expertise to improve the scale and depth of product security analysis.

Key Responsibilities

Product & Firmware Security

• Assess hardware and firmware architectures from both defensive and attacker perspectives.
• Perform threat modeling and security risk assessments across embedded-system architectures.
• Evaluate security mechanisms including secure boot, roots of trust, firmware update and recovery, cryptography and key management, authentication, anti-rollback, provisioning, lifecycle controls, and debug/manufacturing interfaces.
• Identify attack paths and control gaps and work with engineering teams to develop practical mitigations.
• Support security readiness assessments and review security evidence including static analysis, SBOM/dependency analysis, fuzzing, penetration testing, and security validation results.

Adversarial Security Engineering

• Perform hands-on adversarial assessments of firmware and embedded products.
• Conduct firmware extraction, binary analysis, reverse engineering, vulnerability research, fuzzing, and runtime analysis.
• Analyze boot flows, firmware update mechanisms, trust boundaries, device interfaces, and security-critical components.
• Develop and validate attack hypotheses and proof-of-concept techniques to determine realistic exploitability.
• Analyze interfaces such as JTAG, UART, SPI, PCIe, and NVMe where applicable.
• Correlate findings across static analysis, reverse engineering, fuzzing, runtime analysis, and architecture review to identify multi-stage attack chains.
• Develop reusable adversarial testing tools, automation, and security playbooks.

AI-Assisted & Agentic Security Engineering

• Develop AI-assisted workflows for firmware analysis, threat modeling, vulnerability discovery, fuzzing, and security triage.
• Integrate LLMs with security tools, APIs, scripts, and analysis systems to automate security engineering workflows.
• Develop agentic workflows capable of invoking tools, analyzing results, developing attack hypotheses, and recommending subsequent testing.
• Ensure AI-generated security findings are validated through reproducible technical testing and appropriate human review.

PSIRT & Vulnerability Management

• Support PSIRT activities including vulnerability triage, technical investigation, CVSS assessment, remediation, and coordinated vulnerability response.
• Reproduce and validate externally reported or internally discovered vulnerabilities.
• Translate vulnerability findings into durable improvements to product architecture and development practices.

Required

• Bachelor’s degree or greater in Computer Science, Electrical Engineering, Computer Engineering, Cybersecurity, or a related technical field.
• 5+ years of experience in product security, embedded systems, firmware engineering, vulnerability research, offensive security, or related disciplines.
• Strong understanding of embedded and firmware security, secure boot, roots of trust, firmware updates, cryptography, authentication, threat modeling, and vulnerability analysis.
• Hands-on programming or scripting experience with Python, C/C++, or comparable languages.
• Experience with security testing, debugging, reverse engineering, static analysis, fuzzing, or vulnerability analysis.
• Ability to analyze complex systems with an attacker mindset and identify how security controls could be bypassed, chained, or abused.
• Strong technical communication, analytical, and problem-solving skills.

Preferred

• Experience with SSDs, NAND Flash, NVMe, PCIe, or embedded storage architectures.
• Embedded hardware/software development or firmware engineering experience.
• Experience with reverse-engineering tools such as Ghidra, IDA Pro, Binary Ninja, binwalk, or radare2.
• Experience with fuzzing technologies such as AFL++, libFuzzer, boofuzz, or equivalent frameworks.
• Experience with dynamic analysis, debugging, or emulation using GDB, QEMU, Frida, JTAG, or similar technologies.
• Experience developing security automation or reusable adversarial testing frameworks.
• Experience using LLMs for security engineering, vulnerability research, code/firmware analysis, or security automation.
• Familiarity with agentic AI/orchestration technologies such as LangGraph, LangChain, CrewAI, MCP, or equivalent frameworks.
• Familiarity with FIPS 140, Common Criteria, CVSS, PSIRT, penetration testing, and vulnerability management.

The successful candidate does not need experience with every technology listed above. We are looking for someone with strong embedded/firmware security fundamentals, an attacker mindset, hands-on engineering ability, and an interest in applying emerging AI capabilities to adversarial product security.

Sandisk is committed to providing equal opportunities to all applicants and employees and will not discriminate against any applicant or employee based on their race, color, ancestry, religion (including religious dress and grooming standards), sex (including pregnancy, childbirth or related medical conditions, breastfeeding or related medical conditions), gender (including a person’s gender identity, gender expression, and gender-related appearance and behavior, whether or not stereotypically associated with the person’s assigned sex at birth), age, national origin, sexual orientation, medical condition, marital status (including domestic partnership status), physical disability, mental disability, medical condition, genetic information, protected medical and family care leave, Civil Air Patrol status, military and veteran status, or other legally protected characteristics. We also prohibit harassment of any individual on any of the characteristics listed above. Our non-discrimination policy applies to all aspects of employment. We comply with the laws and regulations set forth in the "Know Your Rights: Workplace Discrimination is Illegal” poster. Our pay transparency policy is available here.

Sandisk thrives on the power and potential of diversity. As a global company, we believe the most effective way to embrace the diversity of our customers and communities is to mirror it from within. We believe the fusion of various perspectives results in the best outcomes for our employees, our company, our customers, and the world around us. We are committed to an inclusive environment where every individual can thrive through a sense of belonging, respect and contribution.

Sandisk is committed to offering opportunities to applicants with disabilities and ensuring all candidates can successfully navigate our careers website and our hiring process. Please contact us at [email protected] to advise us of your accommodation request. In your email, please include a description of the specific accommodation you are requesting as well as the job title and requisition number of the position for which you are applying.

Based on our experience, we anticipate that the application deadline will be 09/022/2026 (3 months from posting), although we reserve the right to close the application process sooner if we hire an applicant for this position before the application deadline. If we are not able to hire someone from this role before the application deadline, we will update this posting with a new anticipated application deadline.

#LI-KH1