Senior Hardware, IoT & OT Security Specialist

Role Profile: Senior Hardware, IoT & OT Security Specialist

Location: Pune, India

Reports to: Head – Cybersecurity / Engineering Security (To be finalized)

About Spiro

SPIRO is a Time 100 Influential Company 2024. Our mission is to accelerate access to affordable, clean energy technology in the mobility sector through excellent customer service and continued agility.

Currently building manufacturing and assembling facilities, SPIRO will be the first company to manufacture e-bikes and batteries in Africa, helping to solve import-export imbalances, unlocking economic growth and sustainable development. SPIRO is the largest EV company in Africa and is uniquely focused on Africa's clean industrialization through e-mobility technologies. Designed around swappable batteries and connected to SPIRO's extensive charging infrastructure, our different motorcycle models deliver clean transport built-for-purpose to address local market challenges.

Role Purpose

The Senior Hardware, IoT & OT Security Specialist will be responsible for securing Spiro's connected products, embedded systems, manufacturing environments, and cloud-connected ecosystems. This role will lead security architecture reviews, vulnerability assessments, penetration testing, threat modeling, and security assurance activities across hardware, firmware, IoT, Operational Technology (OT), and industrial systems.

The role plays a critical part in ensuring secure-by-design product development, protecting connected vehicle technologies, manufacturing infrastructure, and industrial control systems while maintaining compliance with global cybersecurity standards and industry best practices.

Key Accountabilities

Security Architecture & Product Security

• Conduct security architecture reviews for hardware, firmware, IoT devices, embedded systems, OT environments, and cloud-connected platforms.
• Define and implement secure-by-design principles across products, connected devices, and industrial environments.
• Lead product security assessments and security sign-offs for new technologies and product releases.
• Collaborate with engineering teams to embed cybersecurity throughout the product development lifecycle.

Vulnerability Assessment & Penetration Testing

• Perform vulnerability assessments, penetration testing, and ethical hacking across hardware, firmware, embedded systems, IoT devices, and industrial control systems.
• Identify, prioritize, and manage security vulnerabilities while tracking remediation activities.
• Conduct threat modeling exercises to proactively identify security risks and mitigation strategies.
• Validate the effectiveness of implemented security controls.

Embedded & IoT Security

• Assess and strengthen embedded security mechanisms including Secure Boot, TPM, HSM, TrustZone, OP-TEE, and cryptographic implementations.
• Evaluate certificate management, device identity, secure communication protocols, and OTA (Over-the-Air) update mechanisms.
• Secure connected devices against emerging threats throughout the product lifecycle.
• Support firmware security reviews and embedded software hardening initiatives.

Operational Technology (OT) Security

• Support OT cybersecurity initiatives across manufacturing and industrial environments.
• Assess industrial network security, segmentation strategies, remote access security, and secure communication architectures.
• Strengthen Industrial Control Systems (ICS) security in line with ISA/IEC 62443 requirements.
• Collaborate with operations teams to improve the cybersecurity posture of manufacturing environments.

Compliance & Governance

• Ensure compliance with ISO 21434, ISA/IEC 62443, NIST Cybersecurity Framework, ISO 27001, GDPR, and internal security standards.
• Develop security recommendations aligned with regulatory and industry requirements.
• Support security audits, compliance reviews, and risk assessments.

Cross-functional Collaboration

• Partner with engineering, infrastructure, manufacturing, cloud, and operations teams to improve overall security posture.
• Provide technical guidance on secure product development and industrial cybersecurity.
• Promote cybersecurity awareness and secure engineering best practices across teams.

Experience

• 4–8 years of experience in Hardware Security, Embedded Systems Security, IoT Security, OT/ICS Security, or Product Security.
• Proven experience conducting Vulnerability Assessments (VA), Penetration Testing (PT), ethical hacking, and security architecture reviews.
• Experience working with embedded systems, industrial control systems, and connected products.
• Exposure to cloud-connected IoT ecosystems and enterprise security practices is highly desirable.
• Experience within automotive, electric mobility, manufacturing, or industrial environments is preferred.

Capabilities

• Strong understanding of hardware, firmware, embedded systems, and IoT security principles.
• Expertise in threat modeling, vulnerability management, and security risk assessment.
• Knowledge of industrial protocols such as Modbus, OPC-UA, and Profinet.
• Familiarity with automotive and EV cybersecurity including telematics, Battery Management Systems (BMS), charging infrastructure, and vehicle connectivity.
• Strong analytical and problem-solving skills with the ability to identify and mitigate complex security risks.
• Excellent stakeholder management and cross-functional collaboration abilities.
• Effective communication skills with the ability to influence technical and non-technical stakeholders.
• Continuous learning mindset with awareness of evolving cybersecurity threats and technologies.

Education

• Bachelor's Degree in Cybersecurity, Computer Science, Engineering, or a related technical field.
• Relevant professional certifications such as OSCP, CEH, GICSP, ISA/IEC 62443, ISO 21434, or equivalent are preferred.
• Additional certifications in cloud security, embedded systems, or ethical hacking are advantageous.

Technical Knowledge

• Hardware Security
• Embedded Systems Security
• Secure Boot, TPM, HSM, TrustZone, OP-TEE
• IoT Device Security
• OTA Security & Certificate Management
• Vulnerability Assessment & Penetration Testing (VA/PT)
• Threat Modeling
• Industrial Control Systems (ICS)
• OT Security
• CAN Bus Security
• Industrial Protocols (Modbus, OPC-UA, Profinet)
• Automotive & EV Cybersecurity
• Telematics & Battery Management Systems (BMS)
• Cloud Security
• ISO 21434
• ISA/IEC 62443
• ISO 27001
• NIST Cybersecurity Framework
• GDPR
• AI-assisted Security Testing & Automation Tools