Product Security Engineer

Advanced Resource Managers Ltd; Luton; On-site; GBP 77,000 - 128,000; Part time

Job summary

Advanced Resource Managers Ltd in Luton is seeking a Product Security Engineer to own security across the product lifecycle, from design through maintenance, with emphasis on risk assessments and security controls.

You will work with product development teams to derive security requirements, produce security artefacts and collaborate with security authorities to demonstrate compliance; experience with UK/NATO standards and MBSE is highly regarded.

Qualifications

• Graduate degree in engineering, computing or related field.
• Evidence of further professional study.
• Membership of an NCSC-recognised security body (CIISec/ISC2/ISACA).
• Knowledge of UK/EU/NATO information security standards and frameworks (e.g. UK MOD Secure by Design, ISO27001, NIST SP800).
• Experience producing technical assurance docs (Key Management Plans, Security SOPs, Security Cases).
• Knowledge of cryptographic technologies and key management systems.
• Understanding MBSE and how product security inputs into processes.
• Knowledge of product-specific OS, firmware and software security controls.
• Knowledge of Quantum Cryptography & Quantum Key management.
• Experience or knowledge of threat intelligence sources.
• Knowledge of NATO security policy, risk management and Accreditation.

Responsibilities

• Produce Security Management Plans, work package descriptions and cost estimates for bids and proposals.
• Undertaking security risk assessments, risk mitigation plans, gap analysis and security management documentation for system assurance.
• Define product security requirements and advise development teams on bespoke implementations for product security controls.
• Liaison with internal and external security assurance authorities to demonstrate product compliance.
• Drive collaboration with external security authorities such as the NCSC to underpin security solutions.
• Understand and manage security activities within development, testing and manufacturing environments.
• Advise on platform lockdown/configurations and support penetration testing; analyse results and plan remediations.
• Identify and drive life-cycle security management including obsolescence planning and patch management.
• Lead security incident management with Head of Product Security for EW/FCA.
• Review, maintain and participate in corporate product security policies.
• Deliver product security training to project engineering teams.

Skills

Product security engineering

Security risk assessment

Security documentation

MBSE

Cryptography knowledge

NCSC frameworks knowledge

Education

Graduate degree in engineering or computing

Membership in CIISec/ISC2/ISACA

Job description

Product Security Engineer

Luton

6-month contract

Paying up to Circa £93p/h (Inside IR35)

Please note - Due to the nature of the work, you'll be required to hold a high level of UK Security Clearance

Overview

As the Product Security Engineer /Lead security Engineer, you'll take responsibility for all security aspects of product design, development, verification and maintenance through all phases of the product lifecycle.

The role will focus on undertaking security risk assessments, preparing security risk mitigation plans, deriving security requirements and working closely and directly with product development teams to design, implement and maintain appropriate security controls and the production of wider security artefacts.

Responsibilities

• Production of Security Management Plans, work package descriptions and cost estimates in support of product bids, services and proposals.
• Undertaking security risk assessments, risk mitigation plans, mitigation gap analysis and preparation of security management documentation for system assurance.
• Defining product security requirements, advising development teams on bespoke implementations for product security control implementations and overseeing product development activities.
• Liaison with internal and external security assurance authorities to desmontrate product compliance against recognised UK and wider frameworks.
• Driving collaborative working with external security authorities such as the NCSC to provide underwriting of security solutions.
• Understanding and management of security activities within development, testing and manufacturing environments.
• Advising development teams on suitable platform lockdown and configurations, and supporting penetration test activities. Analysing penetration test results and preparation of remedial action plans.
• Identify, communicate and drive through life security management, including but not limited to obsolescence planning, vulnerability and patch management for all products within area of responsibility.
• Lead security incident management teams during incident/crisis situations in conjunction with Head of Product Security for EW/FCA.
• Review, maintain and participate corporate product security policies.
• Deliver product security training to project engineering teams.

Essential Skills & Experience

• Experience in the development of besoke product-based security solutions for a military and/or commercial products and systems.
• Graduate degree in relevant engineering, computing or related scientific discipline, and/or evidence of further professional study.
• Full membership of an NCSC recognised professional security body organisation (i.e. CIISec, ISC2 or ISACA).
• Recent experience and demonstratable knowledge of live and legacy UK/EU/NATO information security standards and frameworks, including the UK MOD Secure by Design framework, GovS 007, HMG IS1&2, ISO27001, NIST SP800-30/37/53, UK MOD Information Security related JSPs, EU CRA and US DoD information security policies.
• Practical experience of producing technical assurance documentation such as Key Management Plans, Testing Security Instructions, Security Operating Procedures and Security Cases.
• Knowledge of current cryptographic technologies and key management systems.
• Understanding of Model Based System Engineering (MBSE) and how Product Security directly inputs into the process.
• Knowledge and understanding of bespoke product-specific Operating Systems, Firmware and Software security controls and how to apply them.
• Knowledge of Quantum Cryptography & Quantum Key management.
• Experience or knowledge of existing threat intelligence sources.
• Knowledge of NATO security policy, risk management and Accreditation.