Platform Security Software Engineer

About the role

The Software Engineer, Platform Security and API Services helps harden the Control4 controller platform: the embedded Linux system, C++ services and API layer that connect Control4 home automation controllers to mobile apps, touch screens and cloud services. Working with senior platform and security engineers, you will fix vulnerabilities in C++ system services, implement hardening and secure-by-default changes, and build the tooling and evidence supporting compliance with the EU Cyber Resilience Act and the US Cyber Trust Mark. You will also contribute to the Node.js REST, WebSocket and GraphQL services that authenticate client applications and enforce role-based access control. The role is based in the Belgrade office, alongside an existing platform engineer and with teams in the United States.

Key responsibilities

• Reproduce, triage and fix security vulnerabilities in C++ system services on embedded Linux controllers
• Implement platform hardening: least privilege, secure defaults and compiler hardening
• Implement and test changes to the update, device identity and token validation paths
• Build endpoints, resolvers and authorization checks in the Node.js REST, WebSocket and GraphQL API services
• Integrate SBOM generation, vulnerability scanning, sanitizer builds and fuzzing into CI and keep them green
• Fix penetration test findings with regression-preventing tests and document what was built and how it was verified
• Take part in security-focused design and code reviews

Required profile

• 2+ years of professional software engineering experience in modern C++ on Linux
• Understanding of common C and C++ vulnerability classes and hands-on experience with at least one detection tool (sanitizers, static analysis or fuzzing)
• Working knowledge of Linux fundamentals and a basic understanding of TLS, certificates and JWT
• Interest in security and compliance, with willingness to learn the EU Cyber Resilience Act and NIST consumer IoT requirements
• Clear written and verbal communication in English

Required skills

• Modern C++ on Linux
• Automated testing and CI/CD pipelines
• Preferred: JavaScript or TypeScript and Node.js API experience (REST or GraphQL), event-driven messaging (WebSockets, Socket.IO, MQTT) or Rust
• Preferred: embedded Linux, Yocto, ARM or cross-compilation exposure
• Preferred: familiarity with a security standard (CRA, EN 303 645, NIST IR 8425, IEC 62443) or SBOM tooling

What we offer

• Health insurance through Generali, including serious illness, surgery, professional illness and accident coverage
• Sports and recreation membership (Fitpass or Sports Academy Kocovic)
• English classes during working hours
• Employee referral bonus program
• Corporate social events and team building
• Well-equipped office, hybrid work arrangement