Red Team Security Manager

About u-blox AG

u-blox AG is a global technology leader in positioning and wireless communication in automotive, industrial, and consumer markets. Their smart and reliable solutions, services, and products enable people, vehicles, and machines to determine their precise position and communicate wirelessly over cellular and short-range networks. With a broad portfolio of chips, modules, and secure data services and connectivity, u-blox AG is uniquely positioned to empower its customers to develop innovative and reliable solutions for the Internet of Things, quickly and cost-effectively.

Job Description

The Red Team Security Manager will play a critical role in strengthening the security of u-blox AG's products and services. This individual will be responsible for planning, implementing, and overseeing all activities of the red team to ensure independent security assessments, reviews, and penetration tests that are provided as a service to the organization. The successful candidate will collaborate with internal stakeholders across the globe, including Product & Services Security Experts, IT Experts, Testers, and engineers/developers. Maintaining and ensuring the implementation of processes for Red Team operations is a key aspect of this role.

This is an excellent opportunity to apply a broad range of communication, technical, and analytical skills, and grow management skills to support the development of secure products and services at u-blox AG. The Red Team Security Manager will report to the Product & Services Security Manager.

To be successful in this role, the candidate will need to be a self-motivated, strong team player, and self-starter with very good analytical skills.

Responsibilities

1. Plan and execute penetration tests and security assessments of the Red Team.
2. Develop and report Key Performance Indicators (KPIs) for Red Team operations success criteria and ensure regular review and achievement.
3. Coordinate with stakeholders to define scope and plan timelines and vulnerability disclosure to external parties.
4. Coordinate vulnerability monitoring and management operations and the bug bounty program.
5. Ensure availability and functionality of Red Team infrastructure.
6. Lead the Red Team.
7. Support the definition of the Product & Service Security Roadmap.
8. Perform penetration testing against u-blox AG hardware & software products, IoT firmware, and services, along with creating penetration test reports.

Requirements

1. Degree in Computer Science or a comparable field, with specific security certifications being a plus (e.g., CEH, OSCP, CISSP,...).
2. Minimum 5 years of penetration testing/red team experience and minimum 2 years of specific experience in IoT/embedded devices security, ideally with an electronics industry background.
3. Familiarity with firmware security testing is essential.
4. Experience in reverse engineering of firmware binaries and software applications.
5. Firmware update/FOTA attacks.
6. Practical knowledge of interfaces like JTAG, UART, SPI, I2C, and wireless communication protocols (WIFI, MQTT, COAP, GNSS, and BLE).
7. Hands-on track in reverse engineering, using, and writing tools for penetration testing.
8. Perform Threat and Risk Assessment (TARA).
9. Very good English skills, both spoken and written.

Bonus Points

1. Experience with DevSecOps environments is a plus.
2. Experience with AWS security would be considered a plus.
3. Team management experience would be a plus.

Perks

1. A multicultural and international company with over 60 different nationalities.
2. Project-based activities working with colleagues across the globe.
3. A start-up and innovation mindset while in the process of scaling up processes and efficiencies.
4. Hybrid working model and flexible working hours.
5. A strong learning environment and regular career discussions.
6. Company Performance Bonus and RSU.
7. In addition, attractive local and social benefits at each location where the role is available.

u-blox AG values diversity and promotes a culture of inclusion among its employees. The company strives to become a strong learning organization and is committed to providing its employees with equal opportunities regardless of differences such as gender, race, ethnicity, generations, belief.