Senior Aviation Cyber Certification Engineer

Merlin; Boston (MA); Hybrid; USD 140,000 - 200,000; Full time

Benefits offered by this job

Health, dental, life

401k with match

Hybrid work in Boston HQ

Remote applicants considered

Job summary

Merlin is hiring for a civil aviation cybersecurity certification expert based in the Boston area. You will establish and lead the airworthiness security program across programs, including DO-326A/ED-202A, ARP4754B, and DO-356A/ED-203A.

You will coordinate with FAA/EASA and internal engineering teams to create PSecAC, risk assessments, and comprehensive certification evidence as programs move through milestones.

Qualifications

• Bachelor's degree with 6-9 years of cybersecurity or systems security engineering on civil aviation programs.
• Direct experience applying DO-326A/ED-202A, ARP4754B, and DO-356A/ED-203A on aircraft certification.
• Experience interfacing with FAA/EASA or DER/ODA units on security aspects of type certification.

Responsibilities

• Establish civil aviation cyber certification discipline: define processes, templates, artifact structures.
• Lead airworthiness security activities aligned to DO-326A/ED-202A and ARP4754B; develop PSecAC.
• Perform security risk assessments per DO-356A/ED-203A and develop certification evidence.
• Serve as Merlin's technical point of contact with certification authorities on cybersecurity deliverables.

Skills

Cybersecurity experience

Airworthiness certification

FAA/EASA interface

Certification documentation

Education

Bachelor's degree

Tools

RMF

Job description

Merlin (NASDAQ: MRLN) is a publicly traded aerospace and defense company building a non-human pilot to deliver full-stack autonomy for any aircraft from takeoff to touchdown. The Merlin Pilot autonomy system powers a growing range of aircraft and mission profiles and has been proven through hundreds of autonomous flights from Merlin's global flight test facilities, including Kerikeri, New Zealand; Smithfield, Rhode Island; and soon, Bedford, Massachusetts. Headquartered in Boston, Merlin is expanding its organization to accelerate the development and deployment of its autonomy platform, helping customers solve some of aviation's most pressing challenges, from pilot shortages to improving flight safety. Backed by some of the world's leading investors prior to its public listing, Merlin continues to advance the certification and commercialization of autonomous flight across commercial and defense aviation.

About You

You have hands-on experience navigating airworthiness security certification on a civil aviation program. You understand how DO-326A/ED-202A, ARP4754B, and DO-356A/ED-203A apply to certification programs, and you've built or contributed to a Plan for Security Aspects of Certification (PSecAC) or equivalent artifact where no process existed before. You know how to show compliance to applicable requirements for FAA/EASA or a Designated Engineering Representative (DER) approval.

Responsibilities

• Establish civil aviation cyber certification discipline: define the processes, procedures, templates, and artifact structure needed to support airworthiness security certification as civil aviation programs come online
• Lead airworthiness security activities aligned to DO-326A/ED-202A and ARP4754B, including threat and security risk identification, and develop the Plan for Security Aspects of Certification (PSecAC), supporting Security Development Plan, and PSecAC Summary
• Perform aircraft, system, and item-level security risk assessments per DO-356A/ED-203A, and develop the certification evidence — security risk assessments, verification results, and compliance data — required to support the security aspects of certification
• Serve as technical point of contact with the FAA (and other applicable certification authorities or their designated representatives) on cybersecurity certification deliverables and activities for civil aviation programs
• Partners with systems, software, and safety engineering teams to embed airworthiness security requirements into design and development early, and coordinate security certification activities with the broader certification schedule
• Own the security certification documentation set — security plans, risk assessments, compliance matrices, and means-of-compliance packages — and maintain configuration control as programs move through certification milestones
• Validate and build on the aviation cyber certification-related work already performed by the Lead Engineer, Information Systems Security — including authorization artifacts such as test reports supporting military airworthiness efforts — and serve as Merlin's dedicated subject-matter expert for aviation cyber certification across both military and civil programs

Qualifications

• Bachelor's degree with 6-9 years of cybersecurity or systems security engineering experience, including direct experience on civil aviation airworthiness security or certification programs
• Direct experience applying DO-326A/ED-202A, ARP4754B, and DO-356A/ED-203A on an aircraft or system certification program
• Experience interfacing with the FAA, EASA, or other certification authorities (directly or through a DER/ODA Unit Member (UM)) on the security aspects of a type certification or supplemental type certification (STC) program
• Demonstrated ability to build certification processes, procedures, and documentation from the ground up in the absence of existing infrastructure
• Proven ability to work independently with minimal supervision while coordinating across systems, software, safety, and program management teams

Nice to Have

• Working knowledge of systems security engineering practices (e.g., RMF, vulnerability assessment, DISA STIGs), given crossover with Merlin's defense-side security engineering work
• Background in aerospace, avionics, autonomous systems, or another safety-critical engineering domain where security requirements intersect with airworthiness and safety certification (e.g., familiarity with ARP4761 safety assessment processes)
• U.S. citizenship and eligibility to obtain a security clearance, given crossover with Merlin's defense programs
• Experience mentoring engineers on security requirements or building out a security engineering function/team as a program or company scales
• Familiarity with DoD cyber authorization efforts, including Interim Authorization to Test (IATT) and Authorization to Operate (ATO) processes

Logistics

• We welcome remote applicants for this role, with a preference for candidates based in or willing to relocate to Boston, MA for a hybrid work schedule at our HQ

Merlin Labs offers an innovative, entrepreneurial, and team-focused startup environment. We also offer a top-notch benefits package (health, dental, life, flexible paid time off, and 401k with match) and work/life integration. Being part of the Merlin team allows you to become part of a small team that supports professional development while working together to achieve our mission.

Merlin Labs is an equal opportunity employer and values diversity. We do not discriminate on the basis of race, religion, color, national origin, genetic information, sex (including pregnancy), gender, gender identity and expression, sexual orientation, age, marital status, military service or obligation or disability status, or any other characteristic protected by law. All job offers are contingent upon the candidate passing background and reference checks.

At this time, we are unable to provide visa sponsorship or consider candidates who require visa transfers. Applicants must be authorized to work in the United States without the need for visa sponsorship now or in the future.

In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.

If you require reasonable accommodation in completing an application, interviewing, completing any pre-employment testing, or otherwise participating in the employee selection process, please direct your inquiries to: [e-mail]

Merlin Labs does not accept unsolicited resumes from any source other than directly from candidates.

The compensation range provided is reflective of base salary only, and is a good-faith estimate based on a wide range of factors. The actual offer will be determined by a variety of factors including the candidate's qualifications, skills, experience, education, and training. Highly competitive equity grants are considered part of Merlin's total compensation package. Additionally, Merlin offers top-tier benefits for full-time employees.