Product Security Engineer

CBSbutler Holdings Limited trading as CBSbutler; Caddington; On-site; GBP 110,000 - 124,000; Full time

Job summary

CBSbutler is recruiting a Product Security Engineer for defence and government sector projects. The role focuses on security across the full product lifecycle—from design through deployment and ongoing maintenance—with emphasis on risk assessment, security requirements, risk mitigation, and security controls.

The ideal candidate will have strong product security experience in regulated defence/government environments and be capable of delivering security artefacts and assurance documentation,

Qualifications

• Experience developing product-based security solutions for defence/government environments.
• Experience in security risk assessments and mitigation planning.
• Knowledge of security throughout the product lifecycle.
• Proven ability to produce security artefacts and assurance documentation.

Responsibilities

• Develop Security Management Plans and cost estimates for bids and proposals.
• Undertake security risk assessments and develop mitigation plans.
• Define product security requirements and advise engineering teams.
• Work with product development timelines and security authorities to ensure compliance.
• Support security testing and remediation activities.

Skills

Product Security

Information Security

Cyber Security Engineering

Security risk assessments

Security requirements

Security assurance documentation

MBSE

UK Defence security frameworks

SC clearance

Education

Degree or postgraduate qualification in Engineering/CS/Cyber Security

Job description

Product Security Engineer - Defence & Government

Location: Luton - 90% onsite

Rate: £80-£90 per hour

Security Clearance: Active SC Clearance required

Nationality: UK Eyes Only / Sole British National required

Contract: 12 Months +

The Role

We are seeking an experienced Product Security Engineer to support the development and maintenance of bespoke security capabilities for Defence and Government customers.

You will take responsibility for security across the full product lifecycle, from design and development through verification, deployment and ongoing maintenance.

The role will focus on security risk assessment, security requirements, risk mitigation, security assurance and the implementation of appropriate security controls. You will work closely with product development teams, security assurance authorities, risk owners and engineering SMEs to ensure products meet relevant customer and organisational security requirements.

This is a highly technical role suited to a Product Security professional with experience working across UK Defence, Government, aerospace or other highly regulated environments.

Key Responsibilities

• Develop Security Management Plans, work package descriptions and cost estimates for bids, services and proposals.
• Undertake security risk assessments and develop risk mitigation plans.
• Conduct mitigation gap analysis and produce security management documentation for system assurance.
• Define product security requirements and advise engineering teams on security control implementation.
• Work directly with product development teams throughout the product lifecycle.
• Liaise with internal and external security assurance authorities to demonstrate compliance with relevant security frameworks.
• Work collaboratively with external security authorities, including the NCSC, where required to support security assurance.
• Manage security activities across development, testing and manufacturing environments.
• Advise engineering teams on platform lockdown, secure configuration and security hardening.
• Support penetration testing activities, analyse findings and develop remedial action plans.
• Manage through-life product security, including vulnerability management, patch management and security obsolescence planning.
• Support security incident management and crisis response activities.
• Review and contribute to corporate product security policies and processes.
• Deliver product security training and guidance to engineering teams.
• Produce and maintain technical security artefacts and assurance documentation.

Security Risk & Assurance

You will be responsible for ensuring security risks are appropriately identified, assessed and managed throughout the product lifecycle.

This will include:

• Security risk assessments.
• Risk mitigation planning.
• Security requirements definition.
• Security cases and assurance documentation.
• Mitigation gap analysis.
• Security verification and testing.
• Penetration testing support and remediation.
• Engagement with customer security authorities and risk owners.
• Demonstrating compliance against applicable UK, NATO and international security frameworks.

Product Security Engineering

The role will require a strong understanding of how security controls are applied to bespoke products and systems, including:

• Product-specific operating systems.
• Firmware.
• Software.
• Platform security and hardening.
• Cryptographic technologies.
• Key management systems.
• Secure configuration and lockdown.
• Vulnerability and patch management.
• Security monitoring and incident response.

You will work closely with engineering teams to ensure security requirements are translated into practical and effective technical controls.

Essential Skills & Experience

• Demonstrable experience developing product-based security solutions for military, defence, government or commercial products and systems.
• Strong experience in Product Security / Information Security / Cyber Security Engineering.
• Experience undertaking security risk assessments and developing risk mitigation strategies.
• Experience defining and managing product security requirements.
• Experience producing technical security assurance documentation.
• Experience working directly with engineering and product development teams.
• Strong understanding of security throughout the product lifecycle.
• Practical experience with security assurance and compliance activities.
• Knowledge of UK Defence and Government security frameworks.
• Recent experience with relevant UK/EU/NATO information security standards and frameworks, including:
  • UK MOD Secure by Design
  • GovS 007
  • HMG IS1/IS2
  • ISO 27001
  • NIST SP 800-30, 800-37 and 800-53
  • UK MOD Information Security-related JSPs
  • EU Cyber Resilience Act (CRA)
  • US Department of Defense information security policies
• Experience producing security artefacts such as Key Management Plans, Security Operating Procedures, Security Cases and security testing documentation.
• Knowledge of cryptographic technologies and key management.
• Understanding of Model-Based Systems Engineering (MBSE) and the role of Product Security within the systems engineering lifecycle.
• Understanding of operating system, firmware and software security controls.
• Excellent written and verbal communication skills.
• Strong stakeholder management and influencing skills.
• Ability to work collaboratively with engineering, security and customer stakeholders.
• Active SC Clearance or eligibility for SC clearance with UK Eyes Only requirements.

Desirable Experience

• DV Clearance.
• Practical experience with Common Criteria security evaluation techniques.
• Knowledge of quantum cryptography and quantum key management.
• Experience using threat intelligence sources.
• Knowledge of NATO security policy, risk management and accreditation.
• Understanding of security advisory boards within UK Government or NATO environments.
• Experience supporting security incidents or crisis management activities.
• Experience working across classified or highly sensitive environments.

Qualifications & Professional Membership

• Degree or postgraduate qualification in Engineering, Computer Science, Cyber Security or a related scientific/technical discipline, or equivalent professional experience.
• Professional membership of an NCSC-recognised security organisation such as CIISec, ISC2 or ISACA