IoT Security Analyst (m/f/d)

Location: Campanillas, Málaga, Spain; hybrid work

Company

hirify.global provides safety, security, and sustainability services, including connected-product evaluations through its Cybersecurity Hub.

What you will do

• Perform security evaluations of IoT devices and their ecosystems, including hardware, firmware, companion applications, web interfaces, APIs, and cloud backends.
• Analyze hardware and firmware by identifying UART and JTAG/SWD interfaces, extracting firmware, and reviewing embedded Linux systems.
• Assess BLE, Wi-Fi, Zigbee, MQTT, and other IoT communication protocols.
• Conduct web, API, Android, and iOS penetration tests using OWASP methodologies.
• Support product security certification and compliance projects involving the EU Cyber Resilience Act, ETSI/EN standards, ioXt, MASA, and CASA.
• Document vulnerabilities, risk ratings, and mitigations in technical reports and communicate findings to international customers.

Requirements

• Bachelor’s degree in Telecommunications, Electronics, Computer Engineering, Computer Science, Cybersecurity, or a closely related field.
• 1–2 years of hands-on cybersecurity experience, including professional experience, internships, research, or personal projects; IoT or embedded security is preferred within this requirement.
• Practical knowledge of IoT and embedded systems, including microcontrollers, embedded Linux, firmware, and protocols such as BLE, Wi-Fi, or MQTT.
• Basic hardware security skills, including UART and JTAG/SWD debugging and firmware extraction and analysis with tools such as binwalk or unblob.
• Basic knowledge of web and mobile application security, including OWASP Top 10 and OWASP MASVS, and tools such as Burp Suite.
• Working knowledge of Linux and scripting with Python, Bash, or a similar language.
• Excellent analytical, organizational, and problem-solving skills.
• Strong written and verbal communication skills in English.
• Ability to collaborate effectively in international and multidisciplinary teams.

Nice to have

• Familiarity with OWASP IoT Top 10, ETSI EN 303 645, EN 18031, and other IoT security frameworks and standards.
• Experience with logic analyzers, flash programmers, SDR, embedded-binary reverse engineering with Ghidra, RTOS, Zigbee, Thread, or Matter.
• Hands-on experience in web application and API penetration testing.
• Experience with Frida, Objection, MobSF, jadx, and rooted or jailbroken devices.
• Knowledge of the EU Cyber Resilience Act and product security certification schemes.
• Cybersecurity certifications such as OSCP, eJPT, CWES, BSCP, eMAPT, or IoT/hardware-specific certifications.
• Participation in security communities, CTFs, bug bounty programs, or open-source projects such as GitHub or Hackaday.
• Additional German, Spanish, or Chinese language skills.

Culture & Benefits

• Work in a globally recognized security laboratory within a multidisciplinary Cybersecurity Hub.
• Participate in international projects for top-tier manufacturers and technology companies.
• Collaborate across IoT/hardware, web, and mobile security disciplines.
• Permanent, full-time employment with a 40-hour work week and hybrid working.
• Develop expertise in emerging attack techniques, tools, security practices, and international standards.
• Inclusive workplace committed to valuing diverse experiences, perspectives, and backgrounds.