Cyber Security Architect

BULLIT MANAGEMENT SERVICES LIMITED; Pohjois-Pohjanmaa; On-site; EUR 90,000 - 130,000; Full time

Job summary

BULLIT MANAGEMENT SERVICES LIMITED seeks a Product Security Architect to review and refine threat models and lead security governance across product ecosystems. You will assess architectures, devices, and interfaces to ensure robust security controls and compliance.

Responsibilities include identifying attack surfaces, evaluating trust boundaries, and guiding remediation with cross-functional teams spanning UI, platform software, FPGA development, and build/release processes.

Qualifications

• Experience in threat modeling across software and hardware domains.
• Strong knowledge of product security architecture and security controls.
• Familiarity with secure development lifecycle practices and standards.

Responsibilities

• Review, validate, and refine product threat models using industry-standard methodologies.
• Perform comprehensive security assessments across application UI, Linux platforms, REST APIs, and FPGA-enabled systems.
• Identify attack surfaces, trust boundaries, and security gaps across standalone and integrated product ecosystems.
• Analyze architectures against cybersecurity standards and best practices, including secure boot and hardware-rooted trust.

Skills

Threat Modeling

AppSec

Product Security Architecture

Secure SDLC

Job description

• Review, validate, and refine product threat models using industry-standard methodologies (STRIDE, PASTA, Attack Trees, etc.).
• Perform comprehensive security assessments across:
• Application and UI software
• Linux-based platforms
• REST APIs and digital interfaces
• FPGA-integrated systems
• Build and release environments
• Production processes and customer-facing documentation
• Identify attack surfaces, trust boundaries, and security gaps across standalone and integrated product ecosystems.

Product Security Architecture

• Analyze product architectures against internal cybersecurity standards and industry best practices.
• Assess hardware and software trust boundaries, including:
• Secure Boot and hardware-rooted trust mechanisms
• Review cybersecurity aspects of multi-product solutions and interconnected systems.
• Evaluate container-based architectures, Linux security controls, and API security implementations.

Compliance & Security Governance

• Assess product readiness against EU Cyber Resilience Act (CRA) requirements.
• Create and validate Cryptographic Bill of Materials (CBOM).
• Identify compliance gaps and recommend remediation strategies.
• Update security architecture and design documentation to reflect required cybersecurity controls.
• Develop detailed action plans for remediation, categorized by engineering functions such as:
• UI/Application Development
• Platform Software
• FPGA Development
• Build & Release Teams
• Production/Manufacturing Teams
• Provide ongoing security consulting, design reviews, and implementation guidance.
• Review and approve security improvements implemented by development teams.

Key Skills:

• Threat Modeling
• Application Security (AppSec)
• Product Security Architecture Reviews
• Secure SDLC & Secure-by-Design