Product Security Engineer

CBSbutler Holdings Limited trading as CBSbutler; Luton; On-site; GBP 140,000 - 180,000; Full time

Job summary

CBSbutler Holdings Limited trading as CBSbutler is seeking a Product Security Engineer for Defence & Government with active SC clearance and UK Eyes Only eligibility. Location is Lut on with 90% onsite work.

The role focuses on security across the full product lifecycle, from design to maintenance, and involves risk assessments, requirements definition and security controls implementation. The successful candidate will work with development teams and security authorities to ensure compliance

Qualifications

• Demonstrable experience developing product-based security solutions for military, defence, government or commercial products and systems.
• Strong experience in Product Security / Information Security / Cyber Security Engineering.
• Experience undertaking security risk assessments and developing risk mitigation strategies.
• Experience defining and managing product security requirements.
• Experience producing technical security assurance documentation.
• Experience working directly with engineering and product development teams.
• Strong understanding of security throughout the product lifecycle.
• Practical experience with security assurance and compliance activities.
• Knowledge of UK Defence and Government security frameworks.
• Experience with UK/EU/NATO information security standards and frameworks.

Responsibilities

• Develop Security Management Plans, work package descriptions and cost estimates for bids, services and proposals.
• Undertake security risk assessments and develop risk mitigation plans.
• Define product security requirements and advise engineering teams on security control implementation.
• Work directly with product development teams throughout the product lifecycle.
• Liaise with security assurance authorities to demonstrate compliance with frameworks.
• Manage security activities across development, testing and manufacturing environments.
• Advise on platform lockdown, secure configuration and security hardening.
• Support penetration testing activities and remedial actions.
• Manage through-life product security including vulnerability and patch management.
• Support security incident management and crisis response.

Skills

Security risk assessments

Security lifecycle

Product security requirements

Security assurance documentation

Stakeholder management

Penetration testing support

Security controls implementation

MBSE awareness

Education

Engineering / Computer Science / Cyber Security degree

Job description

Product Security Engineer - Defence & Government

Location: Luton - 90% onsite

Rate: £80-£90 per hour

Security Clearance: Active SC Clearance required

Nationality: UK Eyes Only / Sole British National required

Contract: 12 Months +

The Role

We are seeking an experienced Product Security Engineer to support the development and maintenance of bespoke security capabilities for Defence and Government customers.

You will take responsibility for security across the full product lifecycle, from design and development through verification, deployment and ongoing maintenance.

The role will focus on security risk assessment, security requirements, risk mitigation, security assurance and the implementation of appropriate security controls. You will work closely with product development teams, security assurance authorities, risk owners and engineering SMEs to ensure products meet relevant customer and organisational security requirements.

This is a highly technical role suited to a Product Security professional with experience working across UK Defence, Government, aerospace or other highly regulated environments.

Key Responsibilities

• Develop Security Management Plans, work package descriptions and cost estimates for bids, services and proposals.
• Undertake security risk assessments and develop risk mitigation plans.
• Conduct mitigation gap analysis and produce security management documentation for system assurance.
• Define product security requirements and advise engineering teams on security control implementation.
• Work directly with product development teams throughout the product lifecycle.
• Liaise with internal and external security assurance authorities to demonstrate compliance with relevant security frameworks.
• Work collaboratively with external security authorities, including the NCSC, where required to support security assurance.
• Manage security activities across development, testing and manufacturing environments.
• Advise engineering teams on platform lockdown, secure configuration and security hardening.
• Support penetration testing activities, analyse findings and develop remedial action plans.
• Manage through-life product security, including vulnerability management, patch management and security obsolescence planning.
• Support security incident management and crisis response activities.
• Review and contribute to corporate product security policies and processes.
• Deliver product security training and guidance to engineering teams.
• Produce and maintain technical security artefacts and assurance documentation.

Security Risk & Assurance

You will be responsible for ensuring security risks are appropriately identified, assessed and managed throughout the product lifecycle.

This will include:

• Security risk assessments.
• Risk mitigation planning.
• Security requirements definition.
• Security cases and assurance documentation.
• Mitigation gap analysis.
• Security verification and testing.
• Penetration testing support and remediation.
• Engagement with customer security authorities and risk owners.
• Demonstrating compliance against applicable UK, NATO and international security frameworks.

Product Security Engineering

The role will require a strong understanding of how security controls are applied to bespoke products and systems, including:

• Product-specific operating systems.
• Firmware.
• Software.
• Platform security and hardening.
• Cryptographic technologies.
• Key management systems.
• Secure configuration and lockdown.
• Vulnerability and patch management.
• Security monitoring and incident response.

You will work closely with engineering teams to ensure security requirements are translated into practical and effective technical controls.

Essential Skills & Experience

• Demonstrable experience developing product-based security solutions for military, defence, government or commercial products and systems.
• Strong experience in Product Security / Information Security / Cyber Security Engineering.
• Experience undertaking security risk assessments and developing risk mitigation strategies.
• Experience defining and managing product security requirements.
• Experience producing technical security assurance documentation.
• Experience working directly with engineering and product development teams.
• Strong understanding of security throughout the product lifecycle.
• Practical experience with security assurance and compliance activities.
• Knowledge of UK Defence and Government security frameworks.
• Recent experience with relevant UK/EU/NATO information security standards and frameworks, including:
  • UK MOD Secure by Design
  • GovS 007
  • HMG IS1/IS2
  • ISO 27001
  • NIST SP 800-30, 800-37 and 800-53
  • UK MOD Information Security-related JSPs
  • EU Cyber Resilience Act (CRA)
  • US Department of Defense information security policies
• Experience producing security artefacts such as Key Management Plans, Security Operating Procedures, Security Cases and security testing documentation.
• Knowledge of cryptographic technologies and key management.
• Understanding of Model-Based Systems Engineering (MBSE) and the role of Product Security within the systems engineering lifecycle.
• Understanding of operating system, firmware and software security controls.
• Excellent written and verbal communication skills.
• Strong stakeholder management and influencing skills.
• Ability to work collaboratively with engineering, security and customer stakeholders.
• Active SC Clearance or eligibility for SC clearance with UK Eyes Only requirements.

Desirable Experience

• DV Clearance.
• Practical experience with Common Criteria security evaluation techniques.
• Knowledge of quantum cryptography and quantum key management.
• Experience using threat intelligence sources.
• Knowledge of NATO security policy, risk management and accreditation.
• Understanding of security advisory boards within UK Government or NATO environments.
• Experience supporting security incidents or crisis management activities.
• Experience working across classified or highly sensitive environments.

Qualifications & Professional Membership

Degree or postgraduate qualification in Engineering, Computer Science, Cyber Security or a related scientific/technical discipline, or equivalent professional experience.

Professional membership of an NCSC-recognised security organisation such as CIISec, ISC2 or ISACA