Staff Product Security Engineer

Rivian and Volkswagen Group Technologies is a joint venture between two industry leaders with a clear vision for automotive’s next chapter. From operating systems to zonal controllers to cloud and connectivity solutions, we’re addressing the challenges of electric vehicles through technology that will set the standards for software-defined vehicles around the globe.

About the role

As the Product Security Engineer, you will work closely with the product security organization, the vehicle software development teams, and cloud engineering teams to drive the product development lifecycle for security-related items. Activities include threat assessments and risk analyses for ECUs and features in the RVT automotive ecosystem, derivation of top-level requirements to system specifications, creation of test cases, UN R155-compliant documentation to support CSMS homologation, and a pro-active role in defining risk treatments, security controls, and engineering secure technologies. You will play a critical role in ensuring the security and resilience of RVT’s products, providing technical leadership in securing vehicles and related infrastructure.

Responsibilities

• Perform ECU-level and feature-based threat assessments and risk analyses: define assets, identify threat scenarios, calculate risk values, analyze safety, financial, operational, and privacy impacts, and evaluate attack potential using frameworks like STRIDE or MITRE EMB3D.
• Derive top-level security requirements into system and subsystem specifications in collaboration with the security architecture team, generating concrete requirement specifications for security technologies.
• Validate security requirements by developing and executing both positive and abuse tests at vehicle, system, subsystem, and ECU levels.
• Develop manual and automated test cases in languages such as Python, Go, Java, C, C++, and Rust for multiple architectures, including software-in-the-loop (SIL) and hardware-in-the-loop (HIL) setups, as well as supplier parts without source code access.
• Document validation testing by compiling and triaging test reports, sharing results with the product security team and JV partners to support UN R155 compliance documentation and CSMS processes.
• Collaborate with software development teams to review test results, suggest mitigations for failed tests, validate fixes, and work with the security engineering team operating security HILs.

Qualifications

• M.Sc. in Information Security, Computer Science, Computer Engineering, or a related field.
• 8+ years of experience in risk analysis, testing, and validation of security requirements for embedded device development.
• 5+ years of experience in the automotive industry or embedded device development.
• 3+ years of experience validating security requirements on electronic control units (ECUs).
• Knowledge of ISO 21434 and UN R155 standards and their application for security validation, type approval, and homologation.
• Ability to work in a fast-paced development environment with strong teamwork and communication skills.
• Hands-on approach with proactive problem-solving.

Pay

Compensation range: $206,500 - $258,100. Full-time positions are eligible for an annual performance bonus and equity in the form of Restricted Stock Units (RSUs), subject to board approval and plan terms.

Benefits

Comprehensive benefits package designed to support health, wellbeing, and financial future for full-time employees, including health coverage, retirement savings, time off, and family planning programs. Offerings vary by country.