Product Security Researcher

Please note that the salary range referenced is a general guideline only. Salary differentials are based on multiple factors including (but not limited to), geographic location, education/training, years of relevant experience/seniority, merit, qualifications, as well as market and business considerations. Mitsubishi Electric Iconics Digital Solutions considers all of these variables when extending an offer of employment.

Position Overview

The Product Security Researcher is a technical product security role responsible for investigating vulnerabilities, supporting vulnerability disclosure, improving product security assurance, and providing technical evidence for cybersecurity compliance.

As a member of the Product Security team, this role will work closely with the Product Security Incident Response Team (PSIRT), Engineering, and QA to analyze security findings, reproduce vulnerabilities, develop proof-of-concept tests, validate remediation, prepare draft advisories, and support compliance with the EU Cyber Resilience Act (CRA) and IEC 62443-4-1 / 4-2.

Key Responsibilities

1. Vulnerability Research & PSIRT Support

• Review, triage, reproduce, and investigate product vulnerability reports.

• Determine affected products, exploitability, severity, and technical impact.

• Analyze CVEs and vulnerabilities affecting third-party and open-source components.

• Work with Engineering and QA on root-cause analysis, security tests, remediation, and fix validation.

• Support CVSS scoring and preparation of security advisories, CVE information, VEX statements, and customer communications.

• Maintain technical evidence supporting vulnerability and disclosure decisions.

2. Product Security Assurance

• Review findings from SAST, SCA, DAST, vulnerability scanners, SBOM analysis, and penetration testing.

• Investigate potential false positives and determine whether findings are applicable or exploitable.

• Develop security tests and work with QA to incorporate appropriate tests into regression testing.

• Support security testing and assessment of third-party components.

• Use approved AI tools to assist vulnerability analysis, research, and test development while independently validating conclusions.

• Identify recurring security weaknesses and recommend improvements to development and testing practices.

3. Compliance Technical Support

• Perform technical gap analysis and provide supporting evidence for EU CRA compliance.

• Contribute security-related content and evidence for CRA technical documentation and conformity-assessment activities.

• Support IEC 62443-4-1 and IEC 62443-4-2 assessments, evidence collection, and remediation activities.

• Coordinate technical evidence and responses for internal and external security audits.

• Maintain traceability between security requirements, product implementation, testing, vulnerabilities, and supporting evidence.

Required Qualifications/Certifications

Education & Experience

• 5+ years of relevant experience, or a related bachelor’s degree and 2+ years of relevant experience.

• Experience in product security, vulnerability research, application security, penetration testing, PSIRT, or security testing.

• Strong understanding of common software vulnerabilities, exploitation concepts, CVE/CWE, and CVSS.

• Experience reproducing vulnerabilities and analyzing third-party component vulnerabilities.

• Ability to develop security tests or scripts using Python, PowerShell, Bash, C/C++, C#, or similar languages.

• Familiarity with security-testing, debugging, vulnerability-scanning, and software-composition-analysis tools.

• Strong technical writing and communication skills.

• Ability to collaborate effectively with Engineering, QA, Product Security, and other stakeholders.

Technical Skills

• Experience with coordinated vulnerability disclosure or PSIRT processes.

• Experience supporting security audits or product cybersecurity certification.

• Familiarity with threat modeling, penetration testing, SAST/SCA/DAST, and secure development lifecycle practices.

• Experience with ICS/OT, SCADA, HMI, or industrial automation products preferred.

• Knowledge of IEC 62443-4-1 / 4-2 and the EU Cyber Resilience Act preferred.

• Familiarity with SBOM, CycloneDX, SPDX, CSAF, and VEX preferred.

• Relevant certifications such as CSSLP, GICSP, CISSP, OSCP, GIAC, or IEC 62443 training/certification are beneficial.

Location & Travel

• Hybrid role based in Foxborough, MA, with limited travel to the Cambridge office.

• Up to 5% travel may be required.

About Mitsubishi Electric Iconics Digital Solutions, Inc.

Mitsubishi Electric Iconics Digital Solutions, Inc., headquartered in Foxborough, Massachusetts, is a global leader in industrial automation, smart and sustainable buildings, and digital transformation software. Our innovative HMI, SCADA, and Smart Building solutions help organizations around the world visualize, monitor, and optimize their most critical assets and environments.

With a presence in over 100 countries and trusted by more than 70% of Global 500 companies, we’re proud to play a key role in shaping the future of manufacturing, infrastructure, and the built environment sectors. Backed by more than 40 years of technological innovation and deep industry expertise, we deliver flexible, scalable, and high-performance solutions that drive operational efficiency and continuous improvement.

What makes us different is our people. We are a global, collaborative community of innovators, problem-solvers, and forward-thinkers who are passionate about making a meaningful impact. Whether you’re working alongside colleagues across Europe, the Americas, or Asia, you’ll be part of a team that values knowledge sharing, diverse perspectives, and continuous learning.

We are committed to creating an environment where employees can grow, contribute, and thrive—offering opportunities to work on cutting-edge technology, tackle real-world challenges, and help build smarter, more sustainable communities.

As a testament to our excellence and strong partnership with Microsoft, Mitsubishi Electric Iconics Digital Solutions has been recognized as a seven-time Microsoft Partner of the Year award winner.

Join us and be part of a global organization where your ideas matter, your growth is supported, and your work helps shape the future.

Benefits:

• Hybrid work schedule

• PTO

• Paid sick leave

• 13 holidays

• 401(k) with company match and contribution

• Employee Assistance Program

• Health, dental, and vision insurance

• Flexible Spending Account