Product Security Engineer

ARM; Caddington; On-site; GBP 190,000 - 195,000; Full time

Job summary

ARM in Luton is seeking a Product Security Engineer to own security across the product lifecycle, from design through verification and maintenance, including security risk assessments and defining security controls.

This 6-month contract requires a high level of UK security clearance and collaboration with product teams to ensure robust security artefacts and compliance with UK/NATO frameworks.

Qualifications

• Graduate degree in engineering, computing or related field.
• Membership of an NCSC recognised security body (CIISec, ISC2, ISACA).
• Knowledge of UK/EU/NATO security standards and frameworks.
• Experience producing security documentation (KMP, SIPS, SOPs, Security Cases).

Responsibilities

• Produce Security Management Plans and cost estimates.
• Carry out security risk assessments and mitigation plans.
• Define product security requirements for development teams.
• Interface with internal/external security authorities for compliance.
• Collaborate with external authorities like NCSC to underpin security solutions.
• Oversee security activities in development, testing and manufacturing environments.
• Advise on platform lockdowns and security configurations; support pentests and remediation.
• Manage life-cycle security including vulnerability and patch management.
• Lead security incident management with senior stakeholders.
• Review and maintain corporate product security policies.
• Deliver product security training to project teams.

Skills

Security risk assessment

Product security design

Security documentation

Incident management

Stakeholder liaison

Education

Graduate degree in engineering or related field

NCSC security body membership

Job description

Product Security Engineer

Luton

6-month contract

Paying up to Circa £93p/h (Inside IR35)

Please note - Due to the nature of the work, you'll be required to hold a high level of UK Security Clearance

Overview: As the Product Security Engineer /Lead security Engineer, you'll take responsibility for all security aspects of product design, development, verification and maintenance through all phases of the product lifecycle.

The role will focus on undertaking security risk assessments, preparing security risk mitigation plans, deriving security requirements and working closely and directly with product development teams to design, implement and maintain appropriate security controls and the production of wider security artefacts.

Responsibilities

• Production of Security Management Plans, work package descriptions and cost estimates in support of product bids, services and proposals.
• Undertaking security risk assessments, risk mitigation plans, mitigation gap analysis and preparation of security management documentation for system assurance.
• Defining product security requirements, advising development teams on bespoke implementations for product security control implementations and overseeing product development activities.
• Liaison with internal and external security assurance authorities to desmontrate product compliance against recognised UK and wider frameworks.
• Driving collaborative working with external security authorities such as the NCSC to provide underwriting of security solutions.
• Understanding and management of security activities within development, testing and manufacturing environments.
• Advising development teams on suitable platform lockdown and configurations, and supporting penetration test activities. Analysing penetration test results and preparation of remedial action plans.
• Identify, communicate and drive through life security management, including but not limited to obsolescence planning, vulnerability and patch management for all products within area of responsibility.
• Lead security incident management teams during incident/crisis situations in conjunction with Head of Product Security for EW/FCA.
• Review, maintain and participate corporate product security policies.
• Deliver product security training to project engineering teams.

Essential Skills & Experience

• Experience in the development of besoke product-based security solutions for a military and/or commercial products and systems.
• Graduate degree in relevant engineering, computing or related scientific discipline, and/or evidence of further professional study.
• Full membership of an NCSC recognised professional security body organisation (i.e. CIISec, ISC2 or ISACA).
• Recent experience and demonstratable knowledge of live and legacy UK/EU/NATO information security standards and frameworks, including the UK MOD Secure by Design framework, GovS 007, HMG IS1&2, ISO27001, NIST SP800-30/37/53, UK MOD Information Security related JSPs, EU CRA and US DoD information security policies.
• Practical experience of producing technical assurance documentation such as Key Management Plans, Testing Security Instructions, Security Operating Procedures and Security Cases.
• Knowledge of current cryptographic technologies and key management systems.
• Understanding of Model Based System Engineering (MBSE) and how Product Security directly inputs into the process.
• Knowledge and understanding of bespoke product-specific Operating Systems, Firmware and Software security controls and how to apply them.
• Knowledge of Quantum Cryptography & Quantum Key management.
• Experience or knowledge of existing threat intelligence sources.
• Knowledge of NATO security policy, risk management and Accreditation.