Finite State partners with product security teams, the guardians of our connected world, to create transparency for their connected devices and supply chains. Our platform handles connected devices and embedded systems across all industries, including those found in enterprises, healthcare, utilities, connected vehicles, manufacturing facilities, critical infrastructure, and government entities.

We are a fast-growing series-B company with a fully distributed workforce. Led by a team of seasoned experts, we are a mission-driven team passionate about arming our customers with the actionable insights, critical vulnerability data, and remediation guidance necessary to mitigate product risk and protect the connected attack surface. We are committed to a remote first culture.

Job Title: QA Engineer / Senior QA Engineer – AI/ML

Level: Mid to Senior Level

Location: Singapore (ONLY)

Department: Advanced Development (AD)

Reports To: Engineering Manager / QA Lead / Tech Lead

Employment Type: Full-time, Permanent

The Role

We are looking for a QA Engineer / Senior QA Engineer to join our Advanced Development team in Singapore. This role focuses on ensuring the quality, reliability, security, and usability of the AI-powered SaaS product we are developing for product security teams.

This is not a checklist-only QA role. We need someone who can understand complex systems, investigate issues deeply, identify root causes, and help the team ship high-quality software faster. You will work across frontend, backend, APIs, databases, AI workflows, and security data to validate product behavior and improve release confidence.

The ideal candidate is practical, technically strong, detail-oriented, and comfortable solving ambiguous problems in a fast-moving SaaS environment.

What You’ll Do

Own QA for AI-powered SaaS features from requirements review through release validation.
Design and execute test plans for workflows involving vulnerability detection, threat modeling, compliance analysis, dashboards, and AI-assisted recommendations.
Perform functional, regression, exploratory, API, integration, and end-to-end testing.
Investigate issues across frontend, backend, APIs, databases, logs, permissions, and AI-driven workflows.
Validate AI-generated outputs for accuracy, consistency, explainability, usefulness, and risk.
Identify edge cases, failure modes, data issues, access-control gaps, and customer-impacting defects.
Build and maintain automated tests for critical user journeys, APIs, and backend workflows.
Improve test coverage, CI/CD quality gates, regression suites, and release readiness.
Work closely with engineers, product managers, security researchers, and data engineers to clarify requirements and acceptance criteria.
Document defects clearly with reproduction steps, expected behavior, actual behavior, screenshots, logs, and technical context.
Help raise the quality bar through better testing practices, automation, documentation, and team collaboration.

What We’re Looking for

Hands-on experience in QA, quality engineering, test automation, or software testing for SaaS, web applications, or complex software products.
Strong problem-solving ability and curiosity to understand how systems work.
Experience testing modern web applications, APIs, backend services, databases, and distributed systems.
Solid understanding of test planning, defect management, regression testing, exploratory testing, and release validation.
Experience with automation tools such as Playwright, Cypress, Selenium, Pytest, Postman, or similar.
Ability to write scripts, automated tests, or test utilities in Python, JavaScript, TypeScript, or similar languages.
Familiarity with REST APIs, browser developer tools, logs, database queries, Git, Docker, and CI/CD workflows.
Strong attention to detail and ability to spot edge cases, ambiguous behavior, and customer-impacting risks.
Clear communication skills and the ability to document issues in a structured, actionable way.
Ownership mindset: you care about solving real problems, not just finding bugs.
Interest in AI-powered products, cybersecurity, software supply chain security, vulnerability management, or compliance.

Your 90-Day Success Path

30 Days: Learn our product, security domain, architecture, QA process, test environments, and release workflow. Start testing small full-stack features and contributing to manual, exploratory, and automated testing. Build relationships with engineers, product managers, and security researchers.
60 Days: Own QA for meaningful product features end-to-end. Investigate and help resolve complex issues across frontend, backend, API, database, and AI workflows. Improve test coverage for critical user journeys and release validation.
90 Days: Lead QA efforts for complex AI-powered SaaS workflows. Drive improvements in automation, regression coverage, release readiness, and product reliability. Help shape quality standards for AI-native, security-sensitive, customer-facing features. Become a trusted quality partner for engineering, product, and leadership.

Why Finite State?

Be a part of building the leading platform for connected device cybersecurity.
Join a fast-moving team that values transparency, innovation, and impact.
Work fully remotely with a high degree of autonomy and ownership.
Comprehensive Benefits
Investment: We offer learning stipends to support your professional development
Equity: We offer equity so you can share in our growth and success
Help solve some of the most pressing cybersecurity challenges facing connected device manufacturers and the millions of people who depend on them

About Finite State

At Finite State, we're on a mission to secure the connected world. Our platform empowers product security teams to detect vulnerabilities, manage software supply chain risks, and ensure compliance across complex device ecosystems. From IoT to critical infrastructure, we provide unparalleled visibility into firmware and software components, helping organizations protect their products and customers.

We move with urgency and intent — we’re transparent, own outcomes, put customers first, speak up, and learn fast — turning evidence into action. CLARITY is how we move fast without breaking trust.

C - Customer first - Learn from customers. Ship with urgency.
L - Leverage - Outsource the routine. Own the result.
A - Agency - We take responsibility—end to end.
R - Results - Ship value. Improve fast.
I - Integrity - Speak up. Experiment boldly. Be kind.
T - Transparency - Clear context. Faster decisions.
Y - "Why" - Our mission—securing the connected products humanity depends on—is the reason Finite State exists. CLARITY is how we make that mission real, every day, at speed

Bold Innovation – We push boundaries, explore new ideas, and take initiative to solve complex problems.

The Finite State platform brings visibility and control to the supply chains that create connected devices and embedded systems—all in a simple to use platform and at the scale manufacturers need to keep device production on time and on budget. After unpacking and analyzing every file, configuration, and setting in a firmware build, the platform generates a complete bill of materials for software components, identifies known and 0-day vulnerabilities, shows a contextual risk score, and provides actionable insights that product teams can use to secure their software

We are proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. Finite State is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities.

About the company

Finite State automates product security for connected devices and embedded systems such as IoT, medical devices, ICS, and OT. Its platform provides deep visibility into device and supply chain risks and helps with compliance, delivered through a subscription service for continuous visibility and actionable remediation of security issues.

Company Size

51-200

Company Stage

Late Stage VC

Total Funding

$69.5M

Headquarters

Columbus, Ohio

Founded

2017

Get referred to Finite State

See people who can refer or advise you

Simplify's Take

What believers are saying

September 2026 CRA reporting deadlines create immediate demand for evidence-backed vulnerability and compliance workflows.
Embedded World 2026 visibility and awards bolster credibility with OEMs evaluating connected-device security vendors.
April 2026 leadership hires and 2026 Inc. 5000 growth signal commercial momentum and expansion.

What critics are saying

Private-preview AgentOS and early-access language signal unfinished automation, risking buyer skepticism in 2026.
Crowded product-security market from SCA, SBOM, and vulnerability platforms compresses pricing and differentiation.
If CRA workflows stall, Finite State loses urgency when regulatory deadlines normalize by 2027.

What makes Finite State unique

Binary-grounded Product Security OS unifies firmware, binaries, and source into one system of record.
February 2026 AgentOS automates SBOM, VEX, and compliance packages for shipped products.
MergeBase acquisition strengthened source analysis, complementing Finite State's firmware visibility across device supply chains.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Professional Development Budget

Company Equity

Remote Work Options

Growth & Insights and Company News

Headcount

6 month growth

1 year growth

-3%

2 year growth

-8%

Filigran

Sep 29th, 2026

Filigran accelerates global enterprise growth with executive leadership expansion across Americas Sales and cybersecurity.

Filigran accelerates global enterprise growth with executive leadership expansion across Americas Sales and cybersecurity. Company appoints Tim Durkee as SVP of Americas Sales and Mathieu Rigotto as CISO following market expansion and Great Place to Work certification PARIS - Sept. 29, 2026 - Filigran, the European open-source threat management company, today announced two additions to its leadership team: Tim Durkee as senior vice president of sales, Americas, and Mathieu Rigotto as chief information security officer. The strategic hires come as Filigran experiences rapid international growth following record revenue and platform expansion. Durkee brings more than a decade of experience building enterprise sales organizations and taking cybersecurity and enterprise software products to market. Most recently, Durkee served as chief revenue officer at Finite State, where he led global revenue. Previously, he held sales leadership roles at Brinqa and Planview. Based in Austin, Texas, Durkee will lead Filigran's sales organization across the Americas as the company continues to expand its presence in the region. "Filigran has built something differentiated by combining open source with a practical approach to threat exposure management," Durkee said. "I'm excited to help bring that approach to more organizations across the Americas and build on the momentum the company has created." Rigotto brings extensive experience in cybersecurity leadership and security operations. He previously led the cybersecurity business at IMS Networks and served as general manager of Cyblex Technologies, where he oversaw the development and commercialization of cybersecurity technology. More recently, he served in security leadership roles at Free2move, a Stellantis subsidiary. At Filigran, Rigotto will oversee the company's information security strategy as it continues to scale its platform, team and global operations. "Most security teams can tell you what they've patched. Very few can tell you what an attacker could actually reach, which of those exposures matter most, or whether that's still true a month later," Rigotto said. "Filigran built its platform around answering that cycle, and my job is to make sure we hold ourselves to the same standard we help our customers meet." The appointments come as Filigran continues to grow its team and global presence. The company was recently certified as a Great Place to Work in the U.S., France and Australia, recognizing its workplace culture as it builds a team around its mission to advance open-source agentic threat management. Filigran is hiring across the organization, with opportunities for professionals interested in helping shape the future of open-source threat management. To learn more about careers at Filigran and view current openings, visit filigran.io/careers. About Filigran Filigran, a cybersecurity company founded in 2022, offers open-source, AI-powered solutions covering end-to-end threat intelligence management, attack simulation and security posture validation. Its platforms are trusted by more than 6,000 organizations worldwide. Learn more: Website - Blog - LinkedIn Explore related topics and insights

TMCnet

Sep 22nd, 2026

Finite State Product Security OS Named Embedded World North America Best in Show Winner

Finite State Product Security OS Named Embedded World North America Best in Show Winner TMCnet News [September 22, 2026] | / | Finite State Product Security OS Named Embedded World North America Best in Show Winner Finite State, a leader in product security and software supply chain risk management, today announced that its Product Security OS has been named a winner of the embedded world North America 2026 Best in Show Award in the Security category. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260922891497/en/ Presented by Embedded Computing Design, the Best in Show Awards recognize standout products across the embedded technology ecosystem. Entries are evaluated by the Embedded Computing Design content team based on design excellence, relative performance, and market impact/disruption. Finite State Product Security OS gives manufacturers a view of what's inside the connected products they ship and what could put those products at risk. The platform analyzes firmware, binaries, source code, and third-party components, then uses binary-level reachability to determine which vulnerabilities are actually present and exploitable. Instead of treating every vulnerability finding as an engineering problem, Finite State helps teams distinguish theoretical exposure rom real product risk. Since 2024, its reachability engine has analyzed 10.9 million findings and determined that 4.4 million were unreachable, eliminating them from further triage. As a result, triage that once took approximately four hours can now take about 10 minutes. "Knowing that a vulnerability exists is only the beginning. The hard part is knowing whether it's actually in the product, whether it can be reached, and what you can do about it," said Matt Wyckhouse, Founder & CEO of Finite State. "That's where Product Security OS is different. We're giving manufacturers the technical evidence to understand what they're shipping and make faster, more informed security decisions. We're proud to see that approach recognized by Embedded Computing Design." Product Security OS connects security findings with threat models, security requirements, verification, and compliance, creating a continuous link between product design and deployed software. The platform supports more than 50 instruction-set architectures and helps manufacturers generate security and compliance evidence across the product lifecycle. Finite State is showcasing its product security capabilities at embedded world North America in Booth 6110-F, including visibility into firmware and binaries, exploitability-based vulnerability prioritization, and traceable security and compliance evidence across product releases. The company is also presenting technical sessions focused on regulatory evidence, portfolio-scale vulnerability impact analysis, and AI-assisted penetration testing for embedded firmware. About Finite State Finite State empowers device OEMs to ship securely while enabling engineering teams to move at the speed of AI, immediately transforming product artifacts into audit-ready assurance through a single automated workflow. Leveraging deep binary analysis and AI-native execution, the platform unifies code, compiled components, and firmware in minutes - connecting security design with deployed software. By continuously generating SBOMs, VEX, and signed compliance packages, Finite State enables connected device companies across industries such as medical devices and automotive to meet evolving regulations, including the EU Cyber Resilience Act (CRA), and deliver continuous compliance at speed. Learn more at https://finitestate.io/ View source version on businesswire.com: https://www.businesswire.com/news/home/20260922891497/en/ [ Back To TMCnet.com's Homepage] |

TMCnet

Sep 8th, 2026

Finite State Brings Leading-Edge Product Security Insights and AI-Assisted Testing Strategies to Embedded World North America 2026

Finite State Brings Leading-Edge Product Security Insights and AI-Assisted Testing Strategies to Embedded World North America 2026 TMCnet News [September 08, 2026] | / | Finite State Brings Leading-Edge Product Security Insights and AI-Assisted Testing Strategies to Embedded World North America 2026 Finite State, a leader in product security automation for connected devices, today announced its participation in Embedded World North America 2026, taking place September 22-24 at the Anaheim Convention Center in Anaheim, California. Finite State experts will lead three technical sessions examining how manufacturers can build defensible regulatory evidence, determine the impact of newly disclosed vulnerabilities across product portfolios, and apply AI-assisted penetration testing to embedded firmware. Finite State's Embedded World 2026 kicks off on September 9 with an IoT M2M Council (IMC) pre-event webinar featuring Sharon Hagi, Chief Security Officer at Finite State. The company will also participate in on-site IMC programs during Embedded World North America, with final program details to be announced separately. "Manufacturers now have to show what actually shipped, determine which products are affected when a new vulnerability appears, and do both on compressed timelines," said Hagi. "Our sessions are built around the engineering work behind those obligations: evidence tied to binaries, portfolio-scale impact analysis, and a practical understanding of where AI can accelerate firmware testing and where expert review still matters." Finite State Program: Embedded World North America 2026 Wednesday, September 9, 2026, 11:00 a.m. ET - Pre-event webinar Multi-Mode IoT Connectivity Revolution Opens Embedded Doors Panelist: Sharon Hagi, Chief Security Officer, Finite State Hosted by the IoT M2M Council as part of its Embedded IoT Summit, the panel will examine how cellular, satellite, low-power, and hybrid connectivity are reshaping embedded-device design. Hagi will join representatives from emnify, Digi, and Giesecke+Devrient to discuss the security and lifecycle implications of multi-mode connectivity, dynamic switching, and SIM, eSIM, and iSIM architectures. To register for the webinar, visit: Multi-Mode IoT Connectivity Revolution Opens Embedded Doors Tuesday, September 22, 2026, 11:25-11:50 a.m. PT - Safety & Security: Vulnerability and Compliance Workflows Session: Show Your Work: The Engineering Behind Credible Regulatory Documentation Speaker: Doc McConnell, Head of Policy and Compliance, Finite State McConnell will explain how product security teams can move beyond documentation that reflects design intent alone. The session will cover binary-grounded SBOMs, threat models tied to execution evidence, evidence-backed VEX, and continuous evidence generation for regulatory review. Tuesday, September 22, 2026, 11:50 a.m.-12:15 p.m. PT - Safety & Security: Vulnerability and Compliance Workflows Session: When a CVE Drops: Portfolio-Scale Impact Analysis for Embedded Device Manufacturers Speaker: Sharon Hagi, Chief Security Officer, Finite State Hagi will outline an architecture for identifying affected products across large firmware portfolios when a new CVE is disclosed. The session will address normalized binary-derived component inventories, reachability analysis across product variants, evidence-backed VEX and PSIRT operations under compressed reporting deadlines. Wednesday, September 23, 2026, 1:55-2:45 p.m. PT - Embedded AI: Generative and Agentic AI for Embedded Devices When the Bug Hunter Is an Agent: AI-Assisted Pen Testing for Embedded Firmware Speaker: Roland Lindsey, Lead Solutions Engineer, Finite State Lindsey will examine how AI agents are changing offensive testing of embedded firmware. Drawing on a real-world device assessment, the session will address embedded-specific test-harness design, binary and control-flow analysis, hardware-tied execution context, operational guardrails, and the approach's current limitations. During Embedded World North America | On-site IMC program Additional IoT M2M Council Engagement Finite State participant, title, time, and location to be announced Finite State will also participate in an on-site opportunity with the IoT M2M Council. Additional details will be announced when the program is finalized. Meet Finite State at Booth 6110-F Throughout the conference, attendees can visit Booth 6110-F for personalized demonstrations of Finite State's product security capabilities, including visibility into firmware and binaries, exploitability-based vulnerability prioritization, and the generation of traceable security and compliance evidence across product releases. To schedule a meeting with Finite State, visit: Finite State at Embedded World North America 2026 Conference information and registration: Embedded World North America 2026 About Finite State Finite State empowers device OEMs to ship securely while enabling engineering teams to move at the speed of AI, immediately transforming product artifacts into audit-ready assurance through a single automated workflow. Leveraging deep binary analysis and AI-native execution, the platform unifies code, compiled components, and firmware in minutes-connecting security design with deployed software. By continuously generating SBOMs, VEX, and signed compliance packages, Finite State enables connected device companies across industries such as medical devices and automotive to meet evolving regulations, including the EU Cyber Resilience Act (CRA), and deliver continuous compliance at speed. Learn more at https://finitestate.io/ View source version on businesswire.com: https://www.businesswire.com/news/home/20260908336241/en/ [ Back To TMCnet.com's Homepage] |

Crypto Reporter

Aug 25th, 2026

Finite State's Product Security OS named a finalist in the Security category of SiliconANGLE's 2026 TechForward Awards.

Finite State's Product Security OS named a finalist in the Security category of SiliconANGLE's 2026 TechForward Awards. COLUMBUS, Ohio-(BUSINESS WIRE)-#ConnectedDevices-Finite State, a leader in product security and software supply chain risk management, today announced it has been named a finalist in SiliconANGLE's 2026 TechForward Awards in the Security category. Finite State's Product Security OS gives manufacturers an AI-native way to understand, prioritize, and reduce security risk across the connected products they bring to market. By analyzing firmware, identifying vulnerabilities and exposures, and connecting technical findings to the risks that matter most, the platform gives product security teams the evidence they need to make faster, more informed decisions throughout the product lifecycle. "Product security is changing because manufacturers can no longer treat security as a point-in-time exercise, or reduce it to counting vulnerabilities," said Matt Wyckhouse, founder and CEO of Finite State. "Connected products are becoming more software-defined, more complex, and more exposed, while security teams are being asked to prove that the risks they identify are understood and addressed. Our Product Security OS brings the evidence, intelligence, and automation needed to move from finding issues to understanding what matters, taking action, and proving the results." The TechForward Awards recognize the technologies and solutions driving business forward. As the trusted voice of enterprise and emerging tech, SiliconANGLE applies a rigorous editorial lens to highlight innovations reshaping how businesses operate in its rapidly changing landscape. This awards program honors both established enterprise solutions and breakthrough technologies defining the future of business, spanning AI innovation, security excellence, cloud transformation, data platform evolution and blockchain/crypto tech. Finite State was selected from a competitive field of nominees by a panel of industry experts and technology leaders. "Congratulations to this year's finalists," said Dave Vellante, co-founder and co-CEO of SiliconANGLE Media. "Every company on this list earned its place through customer results including renewal rates, expansion revenue and direct feedback from the individuals using these products daily. Our judges evaluate that evidence when deciding who deserves this recognition." Finite State's Product Security OS brings together firmware intelligence, vulnerability analysis, risk prioritization, threat modeling, verification, and governance in a unified platform. Its AI-native capabilities help security teams cut through the noise of findings generated across connected products, zero in on the exposures that pose the greatest risk, and build the evidence needed to drive remediation and security decisions. About SiliconANGLE Media | theCUBE SiliconANGLE Media operates at the intersection of media, technology, and AI through SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI, and theCUBE SuperStudios. Founded by John Furrier and Dave Vellante, theCUBE broadcasts from its studio on the NYSE trading floor and from Silicon Valley, delivering leading live coverage at major tech events worldwide. SiliconANGLE reaches more than 15 million technology professionals and has interviewed over 11,000 C-suite and technical leaders. For more information, visit SiliconANGLE TechForward Awards. About Finite State Finite State empowers device OEMs to ship securely while enabling engineering teams to move at the speed of AI, immediately transforming product artifacts into audit-ready assurance through a single automated workflow. Leveraging deep binary analysis and AI-native execution, the platform unifies code, compiled components, and firmware in minutes - connecting security design with deployed software. By continuously generating SBOMs, VEX, and signed compliance packages, Finite State enables connected device companies across industries such as medical devices and automotive to meet evolving regulations, including the EU Cyber Resilience Act (CRA), and deliver continuous compliance at speed. Learn more at https://finitestate.io/

Finite State

Jul 16th, 2026

Past events.

Past events. From SBOM to submission: operationalizing CRA vulnerability handling. Webinar Virtual The September 11, 2026 CRA deadline is approaching. Join Finite State and ISMG to learn the practical steps manufacturers should take now to build a risk-based vulnerability handling process, prioritize real exposure, and maintain the evidence needed to support ongoing CRA compliance. Thursday, July 16, 2026 12:00 PM EDT Zoom meeting Auto-ISAC Europe Cybersecurity Workshop 2026. Conference In-Person Join Finite State in Maranello for the Auto-ISAC Europe Cybersecurity Workshop, June 23-25. Meet with our team to discuss how automotive organizations can prioritize real exposure and continuously produce audit-ready proof across software-defined vehicle platforms. Jun 24 - Jun 25, 2026 2:00 PM GMT+2 Ferrari Museum, Maranello, Italy Hackers Teaching Hackers 2026. Conference In-Person Join Finite State at Hackers Teaching Hackers, June 3-6 in Canal Winchester, Ohio. Meet with our team to discuss how security teams can unify firmware and source intelligence, prioritize real exposure, and continuously produce audit-ready proof across connected systems and embedded products. Jun 3 - Jun 5, 2026 8:00 AM EDT BrewDog Brewery and TapRoom, Canal Winchester ESCAR 2026. Conference In-Person Join Finite State in Novi for ESCAR USA, May 19-21. Meet with our team to discuss how OEMs and suppliers can unify firmware and source intelligence, prioritize real exposure, and continuously produce audit-ready proof across connected vehicle platforms. May 19 - May 21, 2026 9:00 AM EDT Sheraton Detroit Novi Hotel, Novi IoT Tech Expo north america 2026. Conference In-Person At IoT Tech Expo, see how Finite State transforms firmware, binaries, and source into a single, continuous workflow that prioritizes real exposure and produces audit-ready proof every release. May 18 - May 19, 2026 6:00 AM PDT San Jose McEnery Convention Center, San Jose Health ISAC Spring Summit 2026. Conference In-Person At the Health ISAC Spring Summit 2026, meet with Finite State to see how medical device teams unify firmware, binaries, and source intelligence, prioritize real exposure with reachability, and continuously produce audit-ready security and compliance proof grounded in what actually ships. May 4 - May 8, 2026 1:00 PM EDT Saddlebrook Resort Florida, Wesley Chapel, United States Wi-Fi World congress. Conference In-Person Join Finite State at WiFi World 2026 to see how organizations gain full visibility into shipped software, prioritize real risk with reachability, and produce continuous, audit-ready security and compliance proof. Apr 13 - Apr 15, 2026 6:30 AM PDT Computer History Museum, Mountain View, United States VulnCon 2026. Conference In-Person At VulnCon 2026, meet with Finite State to see how organizations unify firmware and source intelligence, prioritize real exposure with reachability, and continuously produce audit-ready proof grounded in what actually ships. Apr 13 - Apr 16, 2026 4:30 AM PDT DoubleTree Resort by Hilton Hotel Paradise Valley, Scottsdale, United States