Principal Engineer - Product Security

Key responsibilities

• Lead the development and delivery of Interim and Final Security Cases
• Identify, assess and manage Product Security and Information Assurance risks
• Maintain security risk evidence and contribute to programme-level risk registers
• Identify security requirement gaps and support appropriate risk treatment
• Provide Product Security input throughout the systems engineering lifecycle
• Support design reviews, engineering maturity gates and technical assurance activities
• Review and assure security evidence and deliverables produced by suppliers
• Manage security-related technical queries and formal communications
• Support security verification and testing activities
• Work across Product Security, engineering and programme teams to ensure system-level security aligns with wider platform requirements
• Provide technical leadership, guidance and mentoring to other engineers

Experience required

• We are looking for someone with strong experience in Product Security, Systems Security or Information Assurance within complex engineered systems, rather than traditional enterprise IT security.
• Relevant experience is likely to include:
• Security Case development and/or ownership
• Security risk assessment, risk registers and risk management
• Secure by Design
• Security requirements capture, validation and gap analysis
• Systems engineering lifecycle and design assurance
• Supplier security assurance and technical reviews/testing scope and assurance evidence
• Defence, maritime, aerospace, nuclear or another highly regulated engineering environment
• Experience applying relevant UK Government / defence security standards and frameworks, for example JSP 440, JSP 604, HMG IS1 & IS2, RMADS, Defence Standards (Def Stan), ISO 27000 and/or IEC 62443
• Senior stakeholder engagement and the ability to operate as a Product Security SME
• A relevant STEM, Cyber Security or Information Security qualification is desirable, alongside NCSC CCP SIRA or an equivalent professional security qualification.