Product Security Engineer in Luton

Product Security Engineer - Defence & Government

Location

Luton - 90% onsite

Rate

Security Clearance

Active SC Clearance required

Nationality

UK Eyes Only / Sole British National required

Contract

12 Months +

The Role

We are seeking an experienced

Product Security Engineer to support the development and maintenance of bespoke security capabilities for Defence and Government customers.

You will take responsibility for security across the full product lifecycle , from design and development through verification, deployment and ongoing maintenance.

The role will focus on security risk assessment, security requirements, risk mitigation, security assurance and the implementation of appropriate security controls .

You will work closely with product development teams, security assurance authorities, risk owners and engineering SMEs to ensure products meet relevant customer and organisational security requirements.

This is a highly technical role suited to a Product Security professional with experience working across

UK Defence, Government, aerospace or other highly regulated environments .

Key Responsibilities

• Develop Security Management Plans, work package descriptions and cost estimates for bids, services and proposals.
• Undertake security risk assessments and develop risk mitigation plans.
• Conduct mitigation gap analysis and produce security management documentation for system assurance.
• Define product security requirements and advise engineering teams on security control implementation.
• Work directly with product development teams throughout the product lifecycle.
• Liaise with internal and external security assurance authorities to demonstrate compliance with relevant security frameworks.
• Work collaboratively with external security authorities, including the

NCSC , where required to support security assurance.

• Manage security activities across development, testing and manufacturing environments.
• Advise engineering teams on platform lockdown, secure configuration and security hardening.
• Support penetration testing activities, analyse findings and develop remedial action plans.
• Manage through-life product security, including vulnerability management, patch management and security obsolescence planning.
• Support security incident management and crisis response activities.
• Review and contribute to corporate product security policies and processes.
• Deliver product security training and guidance to engineering teams.
• Produce and maintain technical security artefacts and assurance documentation.
• Security Risk & Assurance

You will be responsible for ensuring security risks are appropriately identified, assessed and managed throughout the product lifecycle.

This will include

• Security risk assessments.
• Risk mitigation planning.
• Security requirements definition.
• Security cases and assurance documentation.
• Mitigation gap analysis.
• Security verification and testing.
• Penetration testing support and remediation.
• Engagement with customer security authorities and risk owners.
• Demonstrating compliance against applicable UK, NATO and international security frameworks.
• Product Security Engineering

The role will require a strong understanding of how security controls are applied to bespoke products and systems, including:

• Product-specific operating systems.
• Firmware.
• Software.
• Platform security and hardening.
• Cryptographic technologies.
• Key management systems.
• Secure configuration and lockdown.
• Vulnerability and patch management.
• Security monitoring and incident response.

You will work closely with engineering teams to ensure security requirements are translated into practical and effective technical controls.

Essential Skills & Experience

• Demonstrable experience developing product-based security solutions for military, defence, government or commercial products and systems.
• Strong experience in

Product Security / Information Security / Cyber Security Engineering .

• Experience undertaking security risk assessments and developing risk mitigation strategies.
• Experience defining and managing product security requirements.
• Experience producing technical security assurance documentation.
• Experience working directly with engineering and product development teams.
• Strong understanding of security throughout the product lifecycle.
• Practical experience with security assurance and compliance activities.
• Knowledge of

UK Defence and Government security frameworks .

• Recent experience with relevant UK/EU/NATO information security standards and frameworks, including:
• UK MOD Secure by Design
• HMG IS1/IS2
• UK MOD Information Security-related JSPs
• EU Cyber Resilience Act (CRA)
• US Department of Defense information security policies
• Experience producing security artefacts such as

Key Management Plans, Security Operating Procedures, Security Cases and security testing documentation .

• Knowledge of cryptographic technologies and key management.
• Understanding of

Model-Based Systems Engineering (MBSE) and the role of Product Security within the systems engineering lifecycle.

• Understanding of operating system, firmware and software security controls.
• Excellent written and verbal communication skills.
• Strong stakeholder management and influencing skills.
• Ability to work collaboratively with engineering, security and customer stakeholders.

Active SC Clearance or eligibility for SC clearance with UK Eyes Only requirements.

Desirable Experience

DV Clearance .

• Practical experience with

Common Criteria security evaluation techniques.

• Knowledge of quantum cryptography and quantum key management.
• Experience using threat intelligence sources.
• Knowledge of NATO security policy, risk management and accreditation.
• Understanding of security advisory boards within UK Government or NATO environments.
• Experience supporting security incidents or crisis management activities.
• Experience working across classified or highly sensitive environments.

Qualifications & Professional Membership

• Degree or postgraduate qualification in

Engineering, Computer Science, Cyber Security or a related scientific/technical discipline , or equivalent professional experience.

• Professional membership of an NCSC-recognised security organisation such as

CIISec, ISC2 or ISACA .

#J-18808-Ljbffr