Principal Product Cybersecurity Assurance Engineer

Cybersecurity Jobs; Cambridge (MA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Comprehensive health coverage (US)

23 days PTO

401(k) with employer match

Equity options

Free daily catered lunch

Collaboration with AI/robotics team

Opportunity to influence product

Job summary

Humanoid is seeking a Principal Product Cybersecurity Assurance Engineer in Cambridge, MA, to lead security delivery across the HMND 01 platform family, shaping assurance strategy and supporting certification evidence throughout the lifecycle.

You will drive security requirements for embedded/AI-enabled robotics, partner with cross-functional teams to implement secure architectures, and ensure audits and regulatory obligations are met, including EU/industry standards.

Qualifications

• ISO 27001/27004/27005 and RMF applied to regulated hardware or embedded products.
• Security risk management for highly regulated, safety-critical products.
• IEC 62443 with ISO/SAE 21434 lifecycle adaptation for robotics.
• Engineering lifecycle understanding linking security with systems engineering.

Responsibilities

• Lead cross-functional security engineering teams delivering product security services across HMND 01 lifecycle.
• Define cybersecurity requirements and advise on standards for embedded/AI-enabled robotics.
• Partner with stakeholders to establish security protocols, tools and processes against emerging threats.
• Own audit-ready security artefacts: Security Management Plans, TARA, Risk Assessments, Remediation Plans.
• Drive security assurance across product lifecycle to ensure robust, compliant designs.
• Improve security engineering processes and practices across the organization.
• Ensure compliance with EU Machinery Regulation 2023/1230 and EU Cyber Resilience Act; align with IEC 62443.
• Deliver Independent IA reviews and risk assessments on complex projects; emphasize cyber-physical risk.
• Guide risk assessments, mitigation plans and security documentation for certification.
• Establish and maintain PSIR process and coordinated vulnerability disclosure pipelines.
• Define security monitoring for deployed fleets and feed data back to risk files.
• Support bids with security scope descriptions and cost estimates.
• Represent Humanoid’s security posture in customer engagements and regulatory interactions.

Skills

Security leadership

Regulatory compliance

Threat modelling

Risk management

Effective communication

Tools

KinetIQ VLM/VLA

KinetIQ AI inference pipeline

Cloud-to-robot architecture

IEC 62443

ISO 27001/27004/27005

NIST RMF

ISO/SAE 21434

EU Machinery Regulation 2023/1230

EU Cyber Resilience Act

TARA

STRIDE

PASTA

CAN bus

Ethernet backbone

Wireless interfaces

UL 4600

UL 3300

ISO 13482

Job description

Humanoid builds highly regulated electromechanical and AI-enabled robotic systems, and this role helps ensure the product cybersecurity assurance story holds from concept through post-market deployment. In this onsite Principal Product Cybersecurity Assurance Engineer position in Cambridge, MA, you will lead security engineering delivery across the HMND 01 platform family (Alpha Wheeled and Alpha Bipedal), shape the assurance strategy, and support documentation, incident response readiness, compliance, and certification evidence.

What you’ll do

• Lead and develop a cross-functional team of security engineers, staying accountable for delivery of product security services across product teams throughout the HMND 01 lifecycle.
• Define product cybersecurity requirements and advise development teams on appropriate standards, techniques, and toolchains for embedded and AI-enabled robotic systems.
• Partner with cross-functional stakeholders to establish security protocols, tools, and processes to stay ahead of emerging threats, including attack surfaces tied to the KinetIQ AI inference pipeline and the cloud-to-robot communication architecture.
• Own and maintain audit-ready security artefacts, including Security Management Plans, TARA reports, Risk Assessments, and Remediation Action Plans across both HMND 01 platforms.
• Drive security assurance through the full product lifecycle so HMND 01 designs are robust, compliant, and resilient.
• Improve organisational security engineering capability through continual enhancement of processes and engineering practices.
• Ensure compliance with cybersecurity obligations under EU Machinery Regulation 2023/1230 and the EU Cyber Resilience Act, where cyber controls intersect with safety-critical functions, including alignment with IEC 62443 for industrial/OT product security.
• Deliver independent Information Assurance (IA) reviews and risk assessments on complex, high-impact projects, with emphasis on cyber-physical systems where compromise could cause physical harm.
• Review and guide security risk assessments, risk mitigation plans, mitigation gap analysis, and security management documentation to support system cybersecurity certification.
• Establish and maintain a Product Security Incident Response (PSIR) process, including coordinated vulnerability disclosure, patch deployment pipelines, and post-field incident analysis.
• Define and oversee security monitoring requirements for deployed fleets so field data feeds back into risk files and security artefacts in line with post-market surveillance obligations.
• Support product bid work packages by contributing product security scope descriptions and cost estimates for bids, services, and proposals.
• Represent Humanoid’s security posture in customer and partner engagements, including regulatory consultations and certification body interactions.

Requirements

• Proven hands‑on experience with ISO 27001/27004/27005 and the NIST Risk Management Framework (RMF), applied to regulated hardware or embedded product programmes.
• Experience owning a security risk management system for highly regulated, safety-critical products, with background from automotive, commercial vehicle, or industrial automation environments.
• Working knowledge of IEC 62443, with the ability to adapt ISO/SAE 21434 lifecycle methodologies to a robotic or electromechanical context.
• Solid understanding of engineering development lifecycles and how product cybersecurity connects with systems engineering, functional safety, and hardware/software co-development.
• Ability to interpret penetration test reports and author Remediation Action Plans that address vulnerabilities in a structured, risk-prioritised manner.
• Clear, structured communication skills to explain complex security risk arguments to technical engineers and executive stakeholders.

Preferred

• Familiarity with TARA or equivalent threat modelling methodologies such as STRIDE and PASTA, applied to embedded or OT/IT convergent systems.
• Understanding of secure‑by‑design principles for AI/ML-enabled systems, including securing inference pipelines, model integrity, and cloud‑to‑edge communication paths.
• Exposure to security considerations for CAN bus, Ethernet backbone, or wireless interfaces in mobile, vehicular, or robotic systems.
• Experience contributing to or establishing a PSIRT process or coordinated vulnerability disclosure programme.
• Knowledge of UL 4600, UL 3300, or ISO 13482, including how cybersecurity evidence integrates into safety case arguments.
• Prior engagement with certification bodies such as TUV, UL, and BSI, or standards development organisations including ISO TC 184, IEC TC 65, SAE, and IEEE RAS.

Tools and technologies you’ll work with

• KinetIQ VLM/VLA-based AI framework
• KinetIQ AI inference pipeline
• Cloud-to-robot communication architecture
• IEC 62443, ISO 27001, ISO 27004, ISO 27005
• NIST Risk Management Framework (RMF), ISO/SAE 21434
• EU Machinery Regulation 2023/1230, EU Cyber Resilience Act
• TARA, STRIDE, PASTA
• CAN bus, Ethernet backbone, wireless interfaces
• UL 4600, UL 3300, ISO 13482

Benefits

• Comprehensive health coverage for US-based employees, including fully paid medical, dental, and vision insurance, plus virtual care and employee assistance resources.
• 23 days of PTO (accrued), separate sick leave, and paid company holidays.
• 401(k) retirement plan with 4% employer match.
• Competitive equity with stock options and meaningful upside as the company scales.
• Free daily catered lunch, snacks, and drinks in-office.
• Collaboration with top-tier engineers, researchers, and product experts in AI and robotics.
• Freedom to influence the product and own key initiatives.