Product Cybersecurity Engineer

About TTS-US: Founded in 2011, Toyota Tsusho Systems US, Inc. (TTS-US) is a Toyota group company that develops IT, cybersecurity, and technology solutions to support Toyota’s global business operations. With eight TTS affiliates worldwide, TTS-US is helping establish a secure and resilient Toyota global value chain while continuing to expand its capabilities across cybersecurity, IT consulting, project support, and enterprise solutions.

Summary:

This role helps in ensuring security quality and operational readiness of PCG (Product Cybersecurity Group) products before deployment to market and maintaining alignment to cybersecurity goals throughout the product lifecycle in efforts to meet the customers' goals. Product cybersecurity resilience is an ongoing effort that is expected to carry alongside R&D operations teams for identification of new product changepoints and ensure that cybersecurity goals of the product are upheld throughout the product lifecycle while it is with customer. Throughout the process, technical product knowledge is applied to evaluate residual risk at product launch, and maintenance of that risk throughout the product lifecycle. This technical knowledge is leveraged in Operational Readiness, Operations Management, Vulnerability Assessment, Vulnerability Validation, Countermeasure Validation, and Continuous Testing and Monitoring activities of the scoped products.

Essential Functions:

As an engineer on the Product Cybersecurity Group supporting Operational Readiness, Operations Management, Vulnerability Validation, and Continuous Testing and Monitoring capabilities will be responsible for:

• Performing technical review assessment of products to identify potential risks as assigned, per process.

• Documentation of, and Confirmation of countermeasures for risk reduction of identified items as assigned, per process.

• Documentation of post-launch remediation plans as necessary, and work with necessary teams to ensure timelines are met accordingly as assigned, per process.

• Develop and maintain risk communication materials for product management for new product launches based on information repositories as assigned, per process.

• Execute of Product Cybersecurity Resilience processes for Launch Readiness activities as assigned, per process.

• Performing Vulnerability Validation as needed.

• Performing Continuous Testing as needed.

• Developing custom tooling (HW/SW) as needed for validation efforts.

• Ad-hoc support as a technical expert of PCG (Product Cybersecurity Group) services and programs as required to other PCG Teams/Leadership.

Competencies:

• Strong verbal and written communication skills

• Excellent interpersonal, negotiation, and conflict resolution abilities

• Exceptional organizational skills with keen attention to detail

• High standards of integrity, professionalism, and accountability

• Effective task prioritization, time management, and decision-making capabilities

• Ability to manage competing priorities and delegate responsibilities appropriately

• Strong analytical thinking and problem-solving skills

• Commitment to maintain confidentiality and exercising sound judgment when handling sensitive information

• Proficient with Microsoft Office Suite

Requirements

• Bachelor’s degree (or higher) in Electrical or Computer Engineering, Information Security, or related is (strongly preferred)

• Strong, demonstratable experience of Electrical fundamentals (e.g., reading a schematic, understanding a data sheet, understanding microcontroller architecture and memory models)

• Strong knowledge of core security fundamentals and embedded security best practices (e.g., secure boot, secure debug, secure storage, secure communications)

• Experience with reverse engineering and binary analysis tools (e.g., IDA Pro, Ghidra)

• Experience with on-board communication interfaces such JTAG, SPI, UART, SWD

• Demonstratable experience with hardware lab equipment such as oscilloscopes, logic analyzers,

etc.

• Experience with Linux operating system and comfortability CLI-based tools

• Hands-on programming experience with Python, Bash, C, C++, and ARM

Preferred Qualifications:

• Strong foundation in cloud and network security concepts, including cloud architectures, WAFs, IAM, and security best practices.

• Knowledge about in-vehicle automotive networking protocols (e.g. CAN, LIN)

• Familiarity or experience with Fault Injection Attacks and Side Channel Analysis

• Experience with vulnerability analysis using CVSS scoring and CWE types

• Practical experience with common hardware hacking tools such as Bus Pirate, JTAGulator, Chipwhisperer, etc.

• Strong hardware skills such as SMD/BGA soldering, “chip-off” and reflow.