Senior Engineer II - Product Security at Microchiphr · Trevo

Vulnerability Management & PSIRT Operation
Manage the day-to-day intake, triage, and case management of product vulnerability reports across hardware, firmware, and
software products.
Perform technical vulnerability assessments and apply structured severity scoring (CVSS) to determine impact and
exploitability across Microchip's product categories.
Empower engineering teams in managing vulnerabilities in third-party components and open-source software integrated into
Microchip products, ensuring robust security posture.
Drive remediation coordination with Business Unit engineering teams and security champions.
Collaborate with external security researchers, academia, and coordination centers on vulnerability submissions and
coordinated disclosure activities.
Operate Microchip's coordinated vulnerability disclosure channel
Author security advisories, bulletins, and customer communications in standard publication formats (CSAF); coordinate
multiparty disclosure with upstream and downstream vendors.
Execute CVE assignment and support CNA operations under Microchip's CVE Numbering Authority membership.
Generate and manage PSIRT case tickets for validated vulnerabilities; maintain the case management system as the
operational source of truth.
Monitor internal and external sources (NVD, vendor pre-notifications, SBOM/VEX feeds, Black Duck) to identify security issues
affecting Microchip products.
Run SBOM- and VEX-driven analysis of third-party and open-source components; correlate upstream advisories to affected
products and communicate exploitability status.
Manage incoming third-party vendor vulnerability pre-notifications and coordinate supplier response activities.
Execute statutory incident reporting for actively exploited vulnerabilities under the EU Cyber Resilience Act
Security Standards & Regulatory Enablement
Contribute to new regulations and standardization activities that impact product security, including the EU Cyber Resilience Act
(CRA), IEC 62443, ISO/SAE 21434, ETSI EN 303 645, and sector-specific security frameworks.
Map product security standards requirements to Microchip's development workflows and product architectures, translating
regulatory and standards obligations into practical engineering guidance.
Support the development and maintenance of CRA readiness frameworks — product classification guidance, essential
cybersecurity requirements mapping, conformity assessment preparation, and technical documentation templates.
Define and develop best practices for secure development lifecycle compliance, streamline processes, and drive continuous
improvement initiatives aligned to IEC 62443-4-1, ASPICE, and ISO/SAE 21434.
Track the evolving standards and regulatory landscape (new editions, emerging frameworks, sector-specific requirements) and
communicate relevant updates to PSO leadership and BU security champions.
Work cross-functionally with internal teams (engineering, product management, quality, legal, compliance) to ensure
consistent standards interpretation and timely regulatory readiness.
Draft standard responses to customer security questionnaires, CRA requests, SBOM requests, and vulnerability statements for
review by customer-facing teams.
Coordinate with Quality (QMS integration) and Legal/Compliance (regulatory interpretation) to ensure product security
evidence meets both standards and regulatory expectations.
This role operates within the PSO governance framework, executing and providing feedback on processes and policies defined by PSO leadership.

Requirements

Bachelors degree in Electrical Engineering, Computer Engineering, Electrical and Computer Engineering, Computer Science, Embedded Systems, Cybersecurity, or a closely related engineering field.
7.5+ years of experience in firmware/embedded software development, product security engineering, or vulnerability management — with demonstrable focus on security in embedded systems
Experience in a PSIRT, Security Operations, or security incident response team environment.
Embedded systems and firmware engineering — experience with microcontroller/microprocessor platforms.
Cryptography and hardware security — hands-on experience with cryptographic algorithm integration, hardware security
module (HSM) drivers, security abstraction layers, secure key storage, PUF (Physically Unclonable Function), or Trust Zone
based isolation.
Product security standards — practical working knowledge of one or more: IEC 62443, ISO/SAE 21434, PSA Certified, SESIP,
FIPS 140-3, Common Criteria, ETSI EN 303 645, NIST Cybersecurity Framework
Vulnerability assessment — ability to analyze security vulnerabilities in embedded products, assess exploitability, and apply
structured scoring methodologies (CVSS or equivalent).
Secure development practices — familiarity with secure coding standards (MISRA-C, CERT C), static analysis, and
development lifecycle standards (IEC 62443-4-1).
Technical documentation — ability to author clear technical security documentation, compliance evidence, vulnerability
assessments, and standards-aligned artifacts.
Communication and collaboration — strong written and verbal skills; ability to work cross-functionally with engineering, product
management, quality, legal, and customer-facing teams.
Ability to work independently, taking ownership of security initiatives and improving processes within a defined governance
framework.
Regular business hours; 70% sitting, 15% standing, 15% walking
Microchip Technology Inc is an equal opportunity/affirmative action employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law.
For more information on applicable equal employment regulations, please refer to the Know Your Rights: Workplace Discrimination is Illegal Poster.
To all recruitment agencies: Microchip Technology Inc. does not accept unsolicited agency resumes. Please do not forward resumes to our recruiting team or other Microchip employees. Microchip is not responsible for any fees related to unsolicited resumes.

About the role

What you'll do

Requirements

Nice to have