Principal Engineer - Product Security

Morson Human Resources Limited; Barrow-in-Furness; Hybrid; GBP 234,192,000 - 254,856,000; Full time

Job summary

Morson Human Resources Limited is seeking a Principal Product Security Engineer to support a major UK defence programme. You will provide senior security assurance across the engineering lifecycle of a complex, safety-critical system, including security cases, information risk, and design assurance, collaborating with engineering teams and external suppliers.

This role is a defence platform security SME; it is not enterprise IT or SOC.

Qualifications

• Security Case development and/or ownership.
• Security risk assessment, risk registers and risk management.
• Secure by Design.
• Security requirements capture, validation and gap analysis.
• Systems engineering lifecycle and design assurance.
• Supplier security assurance and technical reviews.
• Security verification/testing scope and assurance evidence.
• Defence, maritime, aerospace, nuclear or another highly regulated engineering environment.
• Experience applying UK Government / defence security standards and frameworks (e.g., JSP 440, JSP 604, HMG IS1 & IS2, RMADS, Def Stan, ISO 27000 and IEC 62443).
• Senior stakeholder engagement and the ability to operate as a Product Security SME.

Responsibilities

• Lead the development and delivery of Interim and Final Security Cases.
• Identify, assess and manage Product Security and Information Assurance risks.
• Maintain security risk evidence and contribute to programme-level risk registers.
• Identify security requirement gaps and support appropriate risk treatment.
• Provide Product Security input throughout the systems engineering lifecycle.
• Support design reviews, engineering maturity gates and technical assurance activities.
• Review and assure security evidence and deliverables produced by suppliers.
• Manage security-related technical queries and formal communications.
• Support security verification and testing activities.
• Work across Product Security, engineering and programme teams to ensure system-level security aligns with wider platform requirements.
• Provide technical leadership, guidance and mentoring to other engineers.

Skills

Product Security

Systems Security

Information Assurance

Security Case

Secure by Design

Systems Engineering Lifecycle

Supplier Security Assurance

Education

STEM/Cyber Security qualification

Job description

Principal Product Security Engineer – Defence

£85.40 per hour Umbrella | 12-month contract
Barrow-in-Furness – Hybrid, typically 1–2 days onsite per month
SC clearance required – active SC strongly preferred

We are recruiting for an experienced Principal Product Security Engineer to support a major UK defence engineering programme.

You will take a senior technical role within the Product Security team, providing security assurance across the engineering lifecycle of a complex, safety-critical system. The position involves Security Cases, information risk, security requirements and design assurance, working closely with engineering teams, programme stakeholders and external suppliers.

This is a Product / Systems Security engineering role supporting a complex defence platform – it is not an enterprise IT, SOC or corporate cyber security position.

Key responsibilities

• Lead the development and delivery of Interim and Final Security Cases
• Identify, assess and manage Product Security and Information Assurance risks
• Maintain security risk evidence and contribute to programme-level risk registers
• Identify security requirement gaps and support appropriate risk treatment
• Provide Product Security input throughout the systems engineering lifecycle
• Support design reviews, engineering maturity gates and technical assurance activities
• Review and assure security evidence and deliverables produced by suppliers
• Manage security-related technical queries and formal communications
• Support security verification and testing activities
• Work across Product Security, engineering and programme teams to ensure system-level security aligns with wider platform requirements
• Provide technical leadership, guidance and mentoring to other engineers

Experience required

We are looking for someone with strong experience in Product Security, Systems Security or Information Assurance within complex engineered systems, rather than traditional enterprise IT security.

Relevant experience is likely to include:

• Security Case development and/or ownership
• Security risk assessment, risk registers and risk management
• Secure by Design
• Security requirements capture, validation and gap analysis
• Systems engineering lifecycle and design assurance
• Supplier security assurance and technical reviews
• Security verification/testing scope and assurance evidence
• Defence, maritime, aerospace, nuclear or another highly regulated engineering environment
• Experience applying relevant UK Government / defence security standards and frameworks, for example JSP 440, JSP 604, HMG IS1 & IS2, RMADS, Defence Standards (Def Stan), ISO 27000 and/or IEC 62443
• Senior stakeholder engagement and the ability to operate as a Product Security SME

A relevant STEM, Cyber Security or Information Security qualification is desirable, alongside NCSC CCP SIRA or an equivalent professional security qualification.