Lead Product Security Engineer

Lead Product Security Engineer

Location:

Luton – hybrid working Rate:

£92.50 per hour Umbrella Contract:

6 months Clearance:

Active SC required; DV desirable Nationality:

Sole British nationals only due to UK Eyes Only requirements We are recruiting for

experienced Lead Product Security Engineers

to support a major organisation within the UK defence sector. The role will take responsibility for security aspects of complex defence products and systems throughout the full engineering lifecycle, from design and development through to verification, maintenance and through-life support. Working closely with product development teams, engineering SMEs, risk owners and security assurance authorities, you will lead security risk and assurance activities, derive product security requirements and ensure appropriate security controls are incorporated into product design. This is a Product/Systems Security Engineering role rather than a corporate IT or enterprise cyber security position. Key Responsibilities

Undertake security risk assessments and develop risk mitigation plans and gap analyses.

Produce Security Management Plans and security documentation supporting product development and assurance.

Define and derive

product security requirements , working directly with engineering teams on their implementation.

Provide security advice throughout product design, development, testing and manufacturing.

Produce technical assurance artefacts including

Security Cases, Security Operating Procedures, Testing Security Instructions and Key Management Plans .

Liaise with internal and external security assurance authorities to demonstrate product compliance.

Apply

MOD Secure by Design

principles throughout the engineering lifecycle.

Work with external security authorities, including the NCSC, to support assurance of security solutions.

Advise engineering teams on platform lockdown, configuration and appropriate product security controls.

Support penetration testing, analyse findings and develop appropriate remediation plans.

Manage through-life security activities including

vulnerability management, patch management and obsolescence planning .

Support security incident and crisis management activities.

Review and contribute to Product Security policies and deliver security guidance and training to engineering teams.

Support bids and proposals through the production of Security Management Plans, work package descriptions and cost estimates.

Skills & Experience

You will ideally have: Significant experience developing and maintaining

bespoke product-based security solutions

within Defence, Government, military or similarly complex engineering environments.

Recent experience of

MOD Secure by Design .

Strong security risk assessment, risk mitigation and technical assurance experience.

Experience deriving and managing

technical security requirements

for products or systems.

Experience producing Security Cases, RMADS and/or comparable security assurance documentation.

Knowledge of UK MOD and Government security standards and frameworks, including

GovS 007, HMG IS1 & IS2 and relevant JSPs .

Knowledge of frameworks including

NIST SP800-30/37/53 and ISO 27001 .

Experience working directly with product development and engineering teams.

Knowledge of current

cryptographic technologies and key management systems .

Understanding of product-specific operating systems, firmware and software security controls.

Understanding of

Model Based Systems Engineering (MBSE)

and how Product Security integrates into the engineering process.

Experience supporting vulnerability management, patching and penetration testing/remediation.

Excellent communication skills with the ability to influence engineering teams, customers and senior stakeholders.

A relevant engineering, computing or scientific qualification and professional security membership such as

CIISec, ISC2 or ISACA

would also be beneficial. Desirable

Current

DV clearance .

Common Criteria security evaluation experience.

NATO security policy, risk management and accreditation experience.

Knowledge of threat intelligence sources.

Knowledge of quantum cryptography and quantum key management.

Experience engaging with UK Government, NCSC or NATO security authorities.

TPBN1_UKTJ