Lead Product Security Engineer

Morson Human Resources Limited; Luton; Hybrid; GBP 110,000 - 147,000; Full time

Job summary

Morson Human Resources Limited seeks an experienced Lead Product Security Engineer in Luton, hybrid, to own security across the full lifecycle of defence products. You will work with engineering teams and security authorities to ensure secure design and through-life support.

The role requires active SC clearance with DV desirable, a track record in risk assessment and security case development, and compliance with MOD standards. Rate of £92.50 per hour Umbrella; six-month contract.

Qualifications

• Significant experience developing bespoke product-based security solutions within Defence or similar complex environments.
• Recent experience of MOD Secure by Design.
• Strong security risk assessment, risk mitigation and technical assurance experience.
• Experience deriving and managing technical security requirements for products or systems.
• Experience producing Security Cases, RMADS or similar security assurance documentation.
• Knowledge of UK MOD and Government security standards including GovS 007, HMG IS1 & IS2 and JSPs.
• Knowledge of NIST SP800-30/37/53 and ISO 27001.
• Experience with cryptographic technologies and key management.
• Understanding MBSE and how Product Security integrates into engineering processes.
• Experience supporting vulnerability management, patching and penetration testing/remediation.
• Excellent communication with stakeholders.
• Beneficial: professional security membership (CIISec, ISC2, ISACA).

Responsibilities

• Lead security risk assessments and mitigation plans.
• Produce Security Management Plans and supporting security documentation.
• Define and derive product security requirements with engineering teams.
• Provide security guidance across design, development, testing and manufacturing.
• Produce Security Cases and related artefacts.
• Liaise with security assurance authorities to demonstrate compliance.
• Apply MOD Secure by Design principles throughout the lifecycle.
• Engage with authorities like NCSC for assurance of security solutions.
• Advise on platform lockdown, configuration and security controls.
• Support vulnerability management and patching activities.
• Contribute to security policies and training for engineering teams.
• Support bids with Security Management Plans and cost estimates.

Skills

Product security

Security risk assessment

MBSE

Security requirements

Threat modelling

Communication skills

Education

Engineering/Computing degree

Job description

Lead Product Security Engineer

Location: Luton – hybrid working
Rate: £92.50 per hour Umbrella
Contract: 6 months
Clearance: Active SC required; DV desirable
Nationality: Sole British nationals only due to UK Eyes Only requirements

We are recruiting for experienced Lead Product Security Engineers to support a major organisation within the UK defence sector.

The role will take responsibility for security aspects of complex defence products and systems throughout the full engineering lifecycle, from design and development through to verification, maintenance and through-life support.

Working closely with product development teams, engineering SMEs, risk owners and security assurance authorities, you will lead security risk and assurance activities, derive product security requirements and ensure appropriate security controls are incorporated into product design.

This is a Product/Systems Security Engineering role rather than a corporate IT or enterprise cyber security position.

Key Responsibilities

• Undertake security risk assessments and develop risk mitigation plans and gap analyses.

• Produce Security Management Plans and security documentation supporting product development and assurance.

• Define and derive product security requirements, working directly with engineering teams on their implementation.

• Provide security advice throughout product design, development, testing and manufacturing.

• Produce technical assurance artefacts including Security Cases, Security Operating Procedures, Testing Security Instructions and Key Management Plans.

• Liaise with internal and external security assurance authorities to demonstrate product compliance.

• Apply MOD Secure by Design principles throughout the engineering lifecycle.

• Work with external security authorities, including the NCSC, to support assurance of security solutions.

• Advise engineering teams on platform lockdown, configuration and appropriate product security controls.

• Support penetration testing, analyse findings and develop appropriate remediation plans.

• Manage through-life security activities including vulnerability management, patch management and obsolescence planning.

• Support security incident and crisis management activities.

• Review and contribute to Product Security policies and deliver security guidance and training to engineering teams.

• Support bids and proposals through the production of Security Management Plans, work package descriptions and cost estimates.

Skills & Experience

You will ideally have:

• Significant experience developing and maintaining bespoke product-based security solutions within Defence, Government, military or similarly complex engineering environments.

• Recent experience of MOD Secure by Design.

• Strong security risk assessment, risk mitigation and technical assurance experience.

• Experience deriving and managing technical security requirements for products or systems.

• Experience producing Security Cases, RMADS and/or comparable security assurance documentation.

• Knowledge of UK MOD and Government security standards and frameworks, including GovS 007, HMG IS1 & IS2 and relevant JSPs.

• Knowledge of frameworks including NIST SP800-30/37/53 and ISO 27001.

• Experience working directly with product development and engineering teams.

• Knowledge of current cryptographic technologies and key management systems.

• Understanding of product-specific operating systems, firmware and software security controls.

• Understanding of Model Based Systems Engineering (MBSE) and how Product Security integrates into the engineering process.

• Experience supporting vulnerability management, patching and penetration testing/remediation.

• Excellent communication skills with the ability to influence engineering teams, customers and senior stakeholders.

• A relevant engineering, computing or scientific qualification and professional security membership such as CIISec, ISC2 or ISACA would also be beneficial.

Desirable

• Current DV clearance.

• Common Criteria security evaluation experience.

• NATO security policy, risk management and accreditation experience.

• Knowledge of threat intelligence sources.

• Knowledge of quantum cryptography and quantum key management.

• Experience engaging with UK Government, NCSC or NATO security authorities.