Cybersecurity Architect: Threat Modeling & Compliance

GlobalLogic; Göteborgs kommun; On-site; SEK 700,000 - 900,000; Full time

Job summary

GlobalLogic is seeking a Cybersecurity Engineer within the System Design department to drive the technical decomposition of cybersecurity requirements into verifiable architecture-level constraints. You will define trust boundaries, attack surfaces, and defense-in-depth strategies while aligning with CRA, ISO/SAE 21434, and UNECE R155/R156 requirements throughout the V-model lifecycle.

You will translate stakeholder requirements into architecture-level and system-level technical requirements,

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Systems Engineering, Electrical Engineering, or a related technical field.
• Demonstrated experience in systems and requirements engineering, specifically in requirement decomposition, allocation, and traceability across system hierarchies.
• Solid technical grounding in secure system design principles, trust boundaries, defense-in-depth, least privilege, secure-by-design/secure-by-default, threat modeling (e.g., STRIDE, attack trees), and secure coding guidelines.
• Proven ability to translate stakeholder and regulatory requirements into both architecture-level and system-level technical requirements.
• Working knowledge of requirements management tooling such as IBM DOORS, Polarion, Jama, or similar applications.
• Familiarity with cybersecurity standards and regulations, including the EU Cyber Resilience Act (CRA), ISO/SAE 21434, IEC 62443, UNECE R155/R156, NIST Cybersecurity Framework, ISO/IEC 27001, or equivalents.
• Strong ability to interpret technical and regulatory standards and convert them into precise, verifiable engineering and architecture requirements.
• Exposure to threat and risk assessment methodology and its linkage to architectural security controls is considered a plus.

Responsibilities

• Requirements Translation: Analyze inputs from cybersecurity stakeholders, customers, and regulatory bodies (CRA, ISO/SAE 21434, IEC 62443, UNECE R155) and translate them into coherent system and sub-system security requirements.
• Security Architecture: Contribute to system design security architecture by defining trust boundaries, security zones and conduits, and conducting data flow and attack surface analysis. Select appropriate security controls (such as authentication, secure communication, cryptographic key management, secure boot, and access control) in collaboration with system architects.
• Requirement Decomposition: Decompose outputs from threat and risk assessments into concrete, verifiable security requirements at the system, sub-system, and component levels. Maintain bidirectional traceability from the threat scenario to the implemented control.
• Architecture Collaboration: Partner with system architects during trade studies to evaluate the security impacts of design alternatives, including segmentation strategy, interface exposure, protocol selection, and HSM/TPM usage
• Regulatory Alignment: Drive alignment with cybersecurity compliance and regulatory teams to ensure that the architecture and requirements satisfy applicable standards and type-approval obligations
• Cross-Functional Alignment: Drive technical alignment across systems engineering, software development, verification, functional safety, and cybersecurity teams to resolve conflicting requirements and design constraints.
• Continuous Improvement: Contribute to the continuous improvement of cybersecurity engineering processes, requirement templates, security architecture patterns, and reusable design guidance

Skills

Secure system design

Threat modeling

Requirements decomposition

Regulatory interpretation

Requirements tooling familiarity

Education

Bachelor’s or Master’s degree in CS/Cybersecurity/Systems Engineering or related field

Job description

GlobalLogic is seeking a Cybersecurity Engineer within the System Design department to drive the technical decomposition of cybersecurity requirements into verifiable architecture-level constraints. You will define trust boundaries, attack surfaces, and defense-in-depth strategies while aligning with CRA, ISO/SAE 21434, and UNECE R155/R156 requirements throughout the V-model lifecycle.

You will translate stakeholder requirements into architecture-level and system-level technical requirements,