IoT Security Analyst (m/f/d)

Since its foundation in 1925, the DEKRA promise has been to ensure the safety of human interaction with technology and the environment. Today, DEKRA employs around 48,000 people across more than 60 countries on all five continents.

Following our 100th anniversary in 2025, our vision remains clear and ambitious: to be the global partner for a safe, secure, and sustainable world.

Within our Cybersecurity Hub, we evaluate the security of connected products end to end, with a strong focus on IoT and embedded devices and their full ecosystem: hardware, firmware, wireless protocols, companion mobile apps, web interfaces and cloud backends. We collaborate with world-leading manufacturers and technology companies to identify risks and vulnerabilities and verify compliance with international security standards and certification schemes.

You will join a globally recognized security lab within a multidisciplinary team covering IoT/hardware, web and mobile security, working on international projects for top-tier customers. We are looking for professionals passionate about IoT and embedded security who also want to grow in web and mobile penetration testing, combining analytical thinking and creativity to help safeguard our digital world.

What will your responsibilities be?

• Perform security evaluations of IoT devices and their full ecosystem (device, companion app and cloud backend) against standards such as EN 18031, ETSI EN 303 645 and OWASP ISVS.
• Analyze hardware and firmware: identify debug interfaces (UART, JTAG/SWD), extract firmware from flash memory or update packages, and review embedded Linux systems for weaknesses.
• Assess wireless and IoT communication protocols such as BLE, Wi-Fi, Zigbee and MQTT.
• Perform penetration tests of web applications and APIs, including device web interfaces and cloud backends, following OWASP WSTG and OWASP ASVS.
• Perform security assessments of Android and iOS applications, including IoT companion apps, following OWASP MASVS/MASTG.
• Support product security certification and compliance projects (e.g., EU Cyber Resilience Act, ETSI/EN standards, ioXt, MASA, CASA) under the guidance of senior team members.
• Prepare clear technical reports documenting vulnerabilities, risk ratings and recommended mitigations, and communicate findings to international customers.
• Stay current with emerging attack techniques, tools and security practices across IoT, web and mobile.

What do we expect from you?

• Bachelor’s degree in Telecommunications, Electronics, Computer Engineering, Computer Science, Cybersecurity, or a closely related field.
• 1–2 years of hands-on experience in cybersecurity, ideally in IoT or embedded security (professional experience, internships, research or personal projects).
• Practical knowledge of IoT and embedded systems (microcontrollers, embedded Linux, firmware) and common IoT communication protocols such as BLE, Wi-Fi or MQTT.
• Basic hardware security skills: identifying and using debug interfaces (UART, JTAG/SWD) and extracting and analyzing firmware (e.g., binwalk, unblob).
• Basic knowledge of web and mobile application security (OWASP Top 10, OWASP MASVS) and tools such as Burp Suite.
• Working knowledge of Linux and scripting (Python, Bash or similar).
• Excellent analytical, organizational, and problem-solving skills.
• Strong written and verbal communication skills in English.
• Demonstrated ability to collaborate effectively in international and multidisciplinary teams.

Ideally, you’ll also have:

• Familiarity with IoT security frameworks and standards such as OWASP IoT Top 10, ETSI EN 303 645 or EN 18031.
• Experience with hardware hacking tools (logic analyzer, flash programmers, SDR), reverse engineering of embedded binaries (e.g., Ghidra), RTOS or IoT ecosystems such as Zigbee, Thread or Matter.
• Hands-on experience in web application and API penetration testing.
• Experience with mobile app testing tools (Frida, Objection, MobSF, jadx) and rooted/jailbroken devices.
• Knowledge of the EU Cyber Resilience Act and product security certification schemes.
• Cybersecurity certifications (e.g., OSCP, eJPT, CWES, BSCP, eMAPT, or IoT/hardware-specific ones), which are valuable but not mandatory.
• Participation in security communities, CTFs, bug bounty programs or open-source projects (e.g., GitHub, Hackaday).
• Additional language skills (German, Spanish, Chinese) would be beneficial

At DEKRA we value your unique experiences, perspectives, and backgrounds. We are committed to an inclusive workplace for all team members.