About the role
RelyBlue is hiring a Product Security Specialist to drive threat modeling and product security risk assessment for our EU Cyber Resilience Act (CRA) and IEC 62443-4-1 / 4-2 program.
What you’ll work on
- Build and maintain threat models for our products using MITRE EMB3D, STRIDE, or tools such as IriusRisk or Microsoft Threat Modeling Tool.
- Define the product security context: intended use, operating environment, interfaces, assets and assumptions.
- Perform product cybersecurity risk assessments and track mitigations with engineering teams.
- Map product security requirements to IEC 62443-4-2 and CRA Annex I, and help prepare the supporting evidence.
- Turn findings into clear, actionable security requirements for developers and product owners.
What we’re looking for
- 3+ years of experience in product security, application security or OT/ICS security.
- Hands-on threat modeling experience with MITRE EMB3D, STRIDE, IriusRisk or Microsoft Threat Modeling Tool.
- Practical experience performing product security risk assessments.
- Working knowledge of IEC 62443-4-1 / 4-2 and the EU CRA.
- Understanding of embedded or connected product architectures.
- Clear written and spoken English.
- VAPT experience on products, devices, web interfaces or APIs.
- Experience setting up or improving a secure SDLC.
- Experience drafting policies, guides and templates for IEC 62443-4-1 and CRA.
- ISA/IEC 62443 certification.
