Lead Engineer - Cybersecurity (Cloud &IOT)

Eaton; Hadapsar; In loco; INR 250.000 - 450.000; Tempo pieno

Descrizione del lavoro

Eaton is seeking a Lead Cybersecurity Engineer to define end-to-end security for cloud IoT products, including devices, gateways, and cloud services. You will lead threat modeling, embed security controls in the CI/CD lifecycle, and own architecture decisions across major releases.

You will mentor engineers, drive reusable security patterns, and ensure robust logging, monitoring and incident readiness for a scalable IoT platform.

Competenze

• Security architecture for cloud IoT devices and services
• Experience with API security, OAuth2/OpenID Connect and JWT
• CI/CD security integration with DevSecOps practices
• Ability to mentor engineers and drive secure design decisions
• Knowledge of AI security across AI/ML lifecycles

Mansioni

• Define end-to-end security architecture for cloud-based IoT products, including devices, gateways, cloud services and data flows.
• Lead threat modeling and security reviews for major releases and hot fixes, with mitigations.
• Embed security controls in CI/CD using GitHub Advanced Security and Black Duck governance.
• Own security architecture decisions and release-security readiness across multiple product lines.
• Design secure logging, monitoring, backup and breach-containment for the IoT platform.

Conoscenze

Cloud IoT security

Threat modeling

DevSecOps

GitHub Advanced Security

Black Duck

AI security

Formazione

Bachelor's or Master's in CS/EC/EE

Strumenti

Threat Modeler

GitHub Copilot

Kubernetes

Descrizione del lavoro

The Lead Cybersecurity Engineer will be part of a global team of security experts driving ‘Security by Design’ philosophy in Eaton Cloud products and solutions.

\"The Lead Engineer – Cloud IoT Security Architecture will be responsible for:

1) Define and maintain the end-to-end security architecture for cloud-based IoT products, including devices, gateways, cloud services, data flows, and multiple cloud APIs.

2) Establish security requirements and architecture guardrails for authentication, authorization, API security, encryption, secrets management, tenant isolation, logging, and monitoring.

3) Lead threat modeling and security design reviews for major releases, minor upgrades, and hot fixes; identify risks early and ensure approved mitigations are incorporated before release.

4) Partner with product, cloud, DevOps, and engineering teams to embed security controls in the CI/CD lifecycle, including GitHub Advanced Security for secure coding and Black Duck for third‑party component governance.

5) Own security architecture decisions, risk acceptance inputs, remediation guidance, and release‑security readiness; collaborate with the penetration‑testing resource while maintaining clear accountability for architecture and design assurance.

6) Create and maintain security architecture artefacts, including trust‑boundary diagrams, data‑flow diagrams, security patterns, control mappings, and architecture decision records to support implementation and auditability.

7) Define security acceptance criteria and review evidence for each release, ensuring critical architecture risks and tool findings are resolved, formally accepted, or tracked with clear remediation plans.

8) Work with cloud operations and incident‑response teams to design secure logging, monitoring, alerting, backup, recovery, and breach‑containment capabilities for the IoT platform.

9) Provide technical leadership and mentoring to architects and engineering teams, evaluate emerging threats and cloud security capabilities, and drive continuous improvement of reusable security standards and patterns.

10) Providing hands‑on guidance to product teams as they implement complex cybersecurity features and requirements in their products, in line with various cybersecurity standards.

11) Define security architecture and assurance requirements for AI‑enabled features and AI/ML services.

12) Integrate and govern GitHub Copilot and other approved AI‑assisted engineering capabilities for security reviews, secure‑code analysis, threat modeling, vulnerability triage, and remediation guidance, with human validation and guardrails for confidentiality, intellectual property, and responsible use."

Qualifications:

Bachelor’s or master’s degree in Computer Science, Electronics Engineering, Electrical Engineering.

Overall 8 to 12 years of Industry Experience

5+ years of relevant experience in Product cybersecurity

Skills:

\"1) Strong hands‑on knowledge of cloud and IoT security architecture, including device‑to‑cloud trust, secure onboarding, identity and access management, network segmentation, data protection, key/certificate management, and zero‑trust principles.

2) Demonstrated expertise in API security for REST and event‑driven interfaces, including OAuth 2.0, OpenID Connect, JWT, mutual TLS, API gateways, rate limiting, input validation, and OWASP API Security risks.

3) Practical experience with threat modeling and security risk assessment using recognized methods such as STRIDE, attack trees, and misuse cases, with the ability to translate findings into implementable architecture requirements.(Handson experience in using Threat Modeler tool for Cloud project)

4) Experience integrating and governing DevSecOps controls in CI/CD pipelines, including GitHub Advanced Security capabilities such as code scanning, secret scanning, and dependency review, plus Black Duck software‑composition analysis and open‑source risk management.

5) Knowledge of secure cloud operations and release governance, including vulnerability management, security logging and monitoring, incident‑response readiness, remediation prioritization, and security approval for frequent releases, hot fixes, and minor upgrades.

6) Ability to design and review security controls for major cloud platforms and services, including containers, Kubernetes, serverless workloads, message brokers, databases, object storage, and infrastructure as code.

7) Strong understanding of security logging, cloud‑native monitoring, SIEM integration, incident response, backup and recovery, and the design of resilient and observable IoT services.

8) Working knowledge of applicable cybersecurity standards and frameworks—such as NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, IEC 62443, and secure product‑development practices—and the ability to map requirements to technical controls.

9) Ability to produce clear security architecture documentation, communicate risk‑based decisions to technical and business stakeholders, mentor engineering teams, and influence design outcomes across multiple product releases.

10) Experience with AI security and Security for AI across the AI/ML lifecycle, including threat modeling of AI systems.

11) Hands‑on experience configuring and using GitHub Copilot for AI‑assisted security reviews, code and design analysis, secure‑coding recommendations, vulnerability triage, and remediation, with prompt governance, approved‑use controls, and human‑in‑the‑loop verification.

12) Ability to apply approved AI tools across the secure product‑development lifecycle to identify security requirements, review architecture and code, generate and validate security test cases, prioritize vulnerabilities, and improve remediation guidance, while ensuring human oversight, data protection, accuracy, and responsible AI use."

\"1) Ability to work in and with diverse & multi‑cultural and geographically dispersed teams

2) Ability to collaborate across multi‑disciplinary teams (legal, IT, product management, project management)

3) Ability to present to various levels of engineering and business leadership globally.

5) Be a technical mentor to other members of the team and beyond as needed"