Product Security Engineer

CBS Butler; Luton; On-site; GBP 110,000 - 124,000; Full time

Job summary

CBS Butler is seeking an experienced Product Security Engineer to support Defence and Government customers in Luton. The role covers security across the full product life cycle, from design to maintenance, with emphasis on risk assessment, requirements, and control implementation.

You will collaborate with development teams, security authorities, and risk owners to ensure compliance with UK and international frameworks.

Qualifications

• Experience delivering product-based security solutions for defence/government or similar regulated environments.
• Strong background in product security engineering and information security.
• Experience conducting security risk assessments and defining mitigations.
• Experience defining product security requirements and producing assurance documentation.
• Experience collaborating with engineering teams and security authorities.

Responsibilities

• Develop Security Management Plans, work package descriptions and cost estimates for bids, services and proposals.
• Undertake security risk assessments and develop risk mitigation plans.
• Conduct mitigation gap analysis and produce security management documentation for system assurance.
• Define product security requirements and advise engineering teams on security control implementation.
• Work directly with product development teams throughout the product life cycle.
• Liaise with internal and external security assurance authorities to demonstrate compliance with relevant security frameworks.
• Manage security activities across development, testing and manufacturing environments.
• Advise engineering teams on platform lockdown, secure configuration and security hardening.
• Support penetration testing activities, analyse findings and develop remedial action plans.
• Manage through-life product security, including vulnerability management, patch management and security obsolescence planning.
• Support security incident management and crisis response activities.
• Review and contribute to corporate product security policies and processes.
• Deliver product security training and guidance to engineering teams.
• Produce and maintain technical security artefacts and assurance documentation.

Skills

Product Security

Information Security

Cyber Security

Security risk assessments

Stakeholder management

SC Clearance

Education

Degree in Engineering/CS/Cyber Security

Job description

Product Security Engineer - Defence & Government

Location: Luton - 90% onsite
Rate: £80-£90 per hour
Security Clearance: Active SC Clearance required
Nationality: UK Eyes Only/Sole British National required
Contract: 12 Months +

The Role

We are seeking an experienced Product Security Engineer to support the development and maintenance of bespoke security capabilities for Defence and Government customers.

You will take responsibility for security across the full product life cycle, from design and development through verification, deployment and ongoing maintenance.

The role will focus on security risk assessment, security requirements, risk mitigation, security assurance and the implementation of appropriate security controls. You will work closely with product development teams, security assurance authorities, risk owners and engineering SMEs to ensure products meet relevant customer and organisational security requirements.

This is a highly technical role suited to a Product Security professional with experience working across UK Defence, Government, aerospace or other highly regulated environments.

Key Responsibilities

• Develop Security Management Plans, work package descriptions and cost estimates for bids, services and proposals.
• Undertake security risk assessments and develop risk mitigation plans.
• Conduct mitigation gap analysis and produce security management documentation for system assurance.
• Define product security requirements and advise engineering teams on security control implementation.
• Work directly with product development teams throughout the product life cycle.
• Liaise with internal and external security assurance authorities to demonstrate compliance with relevant security frameworks.
• Work collaboratively with external security authorities, including the NCSC, where required to support security assurance.
• Manage security activities across development, testing and manufacturing environments.
• Advise engineering teams on platform lockdown, secure configuration and security hardening.
• Support penetration testing activities, analyse findings and develop remedial action plans.
• Manage through-life product security, including vulnerability management, patch management and security obsolescence planning.
• Support security incident management and crisis response activities.
• Review and contribute to corporate product security policies and processes.
• Deliver product security training and guidance to engineering teams.
• Produce and maintain technical security artefacts and assurance documentation.

Security Risk & Assurance

You will be responsible for ensuring security risks are appropriately identified, assessed and managed throughout the product life cycle.

• Security risk assessments.
• Risk mitigation planning.
• Security requirements definition.
• Security cases and assurance documentation.
• Mitigation gap analysis.
• Security verification and testing.
• Penetration testing support and remediation.
• Engagement with customer security authorities and risk owners.
• Demonstrating compliance against applicable UK, NATO and international security frameworks.

Product Security Engineering

The role will require a strong understanding of how security controls are applied to bespoke products and systems, including:

• Product-specific operating systems.
• Firmware.
• Software.
• Platform security and hardening.
• Cryptographic technologies.
• Key management systems.
• Secure configuration and lockdown.
• Vulnerability and patch management.
• Security monitoring and incident response.

You will work closely with engineering teams to ensure security requirements are translated into practical and effective technical controls.

Essential Skills & Experience

• Demonstrable experience developing product-based security solutions for military, defence, government or commercial products and systems.
• Strong experience in Product Security/Information Security/Cyber Security Engineering.
• Experience undertaking security risk assessments and developing risk mitigation strategies.
• Experience defining and managing product security requirements.
• Experience producing technical security assurance documentation.
• Experience working directly with engineering and product development teams.
• Strong understanding of security throughout the product life cycle.
• Practical experience with security assurance and compliance activities.
• Knowledge of UK Defence and Government security frameworks.
• Recent experience with relevant UK/EU/NATO information security standards and frameworks, including:
  • UK MOD Secure by Design
  • GovS 007
  • HMG IS1/IS2
  • ISO 27001
  • NIST SP 800-30, 800-37 and 800-53
  • UK MOD Information Security-related JSPs
  • EU Cyber Resilience Act (CRA)
  • US Department of Defense information security policies
• Experience producing security artefacts such as Key Management Plans, Security Operating Procedures, Security Cases and security testing documentation.
• Knowledge of cryptographic technologies and key management.
• Understanding of Model-Based Systems Engineering (MBSE) and the role of Product Security within the systems engineering life cycle.
• Understanding of operating system, firmware and software security controls.
• Excellent written and verbal communication skills.
• Strong stakeholder management and influencing skills.
• Ability to work collaboratively with engineering, security and customer stakeholders.
• Active SC Clearance or eligibility for SC clearance with UK Eyes Only requirements.

Desirable Experience

• DV Clearance.
• Practical experience with Common Criteria security evaluation techniques.
• Knowledge of quantum cryptography and quantum key management.
• Experience using threat intelligence sources.
• Knowledge of NATO security policy, risk management and accreditation.
• Understanding of security advisory boards within UK Government or NATO environments.
• Experience supporting security incidents or crisis management activities.
• Experience working across classified or highly sensitive environments.

Qualifications & Professional Membership

• Degree or postgraduate qualification in Engineering, Computer Science, Cyber Security or a related scientific/technical discipline, or equivalent professional experience.
• Professional membership of an NCSC-recognised security organisation such as CIISec, ISC2 or ISACA.