Product Cybersecurity Engineer

About this role

May Mobility is transforming cities through autonomous technology to create a safer, greener, more accessible world. Based in Ann Arbor, Michigan, May develops and deploys autonomous vehicles (AVs) powered by our innovative Multi-Policy Decision Making (MPDM) technology that literally reimagines the way AVs think.

Our vehicles do more than just drive themselves - they provide value to communities, bridge public transit gaps and move people where they need to go safely, easily and with a lot more fun. We’re building the world’s best autonomy system to reimagine transit by minimizing congestion, expanding access and encouraging better land use in order to foster more green, vibrant and livable spaces. Since our founding in 2017, we’ve given more than 500,000 autonomous rides to real people around the globe. And we’re just getting started. We’re hiring people who share our passion for building the future, today, solving real-world problems and seeing the impact of their work. Join us.

Job Summary

The Product Cybersecurity Engineer is responsible for ensuring security is embedded throughout the product development lifecycle—from architecture and code to deployment and operations. This role integrates security practices into development workflows, manages vulnerabilities in vehicle and autonomous systems, supports compliance with automotive cybersecurity standards, and serves as a cross-functional security expert bridging cybersecurity, hardware, and product engineering teams.

Essential Responsibilities

• Integrate security practices — threat modeling, architecture reviews into product development workflows from requirements through release.

• Provide early security input on hardware, firmware, and software design decisions, including third-party and supply chain risk considerations.

• Write, review, and validate security requirements across hardware and software domains; enforce secure coding standards and perform security analysis on main compute systems.

• Assist with maintaining Software Bill of Materials (SBOM) and Hardware Bill of Materials (HBOM) using dedicated SBOM tooling to ensure component visibility, vulnerability tracking, and supply chain transparency across products.

• Apply security lenses during safety and functional assessments in collaboration with safety, systems, and software teams.

• Assist in proactive vulnerability patching and support secure update strategies using product security tooling for threat modeling and risk profiling.

• Conduct hazard and threat analyses (TARA/HARA) early in the architecture and development lifecycle.

• Analyze and harden the security architecture of vehicle subsystems and autonomous stacks; define system- and product-level security requirements and ensure validation coverage.

• Assist senior level engineers with Ethernet, in-vehicle networking, and cloud interface configuration, including port security and network segmentation.

• Maintain working knowledge of R155/156, ISO 21434 and UL 4600; support internal audits, risk assessments, and compliance documentation.

• Engage with Auto-ISAC to track emerging threats, attack vectors, and industry best practices.

• Work across teams such as cybersecurity, hardware, and product engineering — providing architectural security design feedback.

• Assist with fostering a security-first culture across the organization through integrated best practices and awareness programs.

• Perform additional responsibilities as directed by your manager.

Skills and Abilities

Success in this role typically requires the following competencies:

• Clear written communication and the ability to align stakeholders on security priorities before executing.

• Excellent attention to detail and a rigorous, systematic approach to security analysis.

• Ability to identify complex security problems across hardware, firmware, and software and devise optimal, innovative solutions that often cross organizational boundaries.

Qualifications and Experience

Candidates most successful in this role typically hold the following qualifications or comparable knowledge or experience:

Required

• B.S. Degree in Computer Science, Computer Engineering, or an equivalent degree

• Minimum of [1-3] years of experience in a product cyber security or related role

• Experience performing threat modeling and attack surface analysis

• Experience generating and managing Software Bills of Materials (SBOMs) using industry tooling, with working knowledge of SBOM formats such as SPDX and CycloneDX

• Familiarity with vehicle communication networks and protocols across physical and application layers (CAN, LIN, Ethernet, DBCs), embedded systems interaction, and module security technologies.

• Familiarity with security-relevant services in ISO 14229-1 (UDS)

• Experience in TARA and HARA methodologies; experience applying UNECE WP.29, ISO/SAE 21434, and security standards.

• Ability to clearly communicate findings and collaborate with engineering teams to drive timely mitigation and remediation.

Desirable

• Experience in automotive product security at an OEM, Tier 1 supplier, or AV company.

• Experience with autonomous vehicle systems and components.

• Familiarity with AUTOSAR security modules, secure boot implementations, and penetration testing tools specific to automotive/embedded domains (e.g., CANalyzer, Wireshark, JTAG debugging).

• Conduct hands-on penetration testing to identify, exploit, and report vulnerabilities across systems, applications, and devices.

Physical Requirements

• Standard office working conditions which includes but is not limited to:

• Prolonged sitting

• Prolonged standing

• Prolonged computer use

• Travel required? – Minimal: 1%-10%

Benefits and Perks

• Comprehensive healthcare suite including medical, dental, vision, life, and disability plans. Domestic partners who have been residing together at least one year are also eligible to participate.

• Health Savings and Flexible Spending Heal

Similar jobs

• Cybersecurity Engineer — Glydways · Remote
• Cybersecurity Engineer — Defenseunicorns · Remote
• Cybersecurity Engineer — Ardentmc · Washington, D.C. Metro
• Cybersecurity Engineer — Agecareers · Columbus, OH
• Cybersecurity Engineer — Accenturefederalservices · Arlington, VA
• Cybersecurity Engineer — Iterativehealth · Cambridge, Massachusetts, United States
• Cybersecurity Engineer — Apollo-information-systems · Remote
• Cybersecurity Engineer — Accenturefederalservices · Fort Meade, MD