Product Cybersecurity Engineer: Threat Modeling & SDLC

Wabtec Corporation; Chicago (IL); On-site; USD 91,000 - 130,000; Full time

Benefits offered by this job

Annual bonus

Health benefits

Retirement plan

Job summary

Wabtec Corporation is seeking a Cybersecurity Engineer to perform ongoing assessments of its products for compliance with Wabtec cybersecurity standards and controls. You will advise product managers and engineering teams, and help define technical controls to address external standards and product requirements.

You will work across the SDLC to implement secure development practices, conduct risk analyses, and communicate cybersecurity concepts to diverse stakeholders.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or a related field.
• 8–10 years of experience in design, development, and testing of web-based, embedded, and/or connected systems.
• 4+ years of hands-on experience in product/application cybersecurity engineering, architecture, risk assessment, or risk management.
• Hands-on experience with security risk assessment methodologies, threat modeling, vulnerability assessments, and security testing.
• Experience with frameworks/standards such as IEC 62443, NIST 800-53, NIST CSF, ISO/IEC 27001 or equivalent.
• Experience in industrial sectors such as rail, transportation, mining, automotive, manufacturing or critical infrastructure preferred.

Responsibilities

• Conduct cybersecurity reviews and assessments of products throughout the SDLC, evaluating compliance with Wabtec policies and controls.
• Partner with engineering teams to perform threat modeling, risk assessments, and security analyses to identify vulnerabilities and attack surfaces.
• Provide expert guidance on cybersecurity principles and risk management, communicating complex concepts to technical and non-technical stakeholders.
• Support cybersecurity consulting across connected products, web services, industrial systems and embedded portfolios.
• Recommend secure design principles, security controls, hardening strategies, and risk mitigation measures.
• Support engineering teams in investigating cybersecurity defects, performing root cause analyses, and implementing corrective actions.
• Develop and deliver cybersecurity training and awareness programs for engineers, product managers, and business stakeholders.
• Contribute to development and improvement of cybersecurity standards, procedures, controls and best practices.
• Promote cybersecurity best practices across the organization to improve product security maturity.
• Collaborate with product teams to integrate cybersecurity requirements into architectures and development processes.
• Support vulnerability disclosure, remediation planning, and security incident response activities.
• Perform other duties and special projects as assigned.

Skills

Threat modeling

Risk assessment

Security testing

Security architecture

DevSecOps

Communicating risk

Education

Bachelor's degree in Computer Science or Cybersecurity

Job description

Wabtec Corporation is seeking a Cybersecurity Engineer to perform ongoing assessments of its products for compliance with Wabtec cybersecurity standards and controls. You will advise product managers and engineering teams, and help define technical controls to address external standards and product requirements.

You will work across the SDLC to implement secure development practices, conduct risk analyses, and communicate cybersecurity concepts to diverse stakeholders.