Lead Product Security Engineer in Luton

Location: Luton – hybrid working

Rate: £92.50 per hour

Umbrella Contract: 6 months

Clearance: Active SC required; DV desirable

Nationality: Sole British nationals only due to UK Eyes Only requirements

We are recruiting for experienced Lead Product Security Engineers to support a major organisation within the UK defence sector. The role will take responsibility for security aspects of complex defence products and systems throughout the full engineering lifecycle, from design and development through to verification, maintenance and through-life support. Working closely with product development teams, engineering SMEs, risk owners and security assurance authorities, you will lead security risk and assurance activities, derive product security requirements and ensure appropriate security controls are incorporated into product design. This is a Product/Systems Security Engineering role rather than a corporate IT or enterprise cyber security position.

Key Responsibilities

• Undertake security risk assessments and develop risk mitigation plans and gap analyses.
• Produce Security Management Plans and security documentation supporting product development and assurance.
• Define and derive product security requirements, working directly with engineering teams on their implementation.
• Provide security advice throughout product design, development, testing and manufacturing.
• Produce technical assurance artefacts including Security Cases, Security Operating Procedures, Testing Security Instructions and Key Management Plans.
• Liaise with internal and external security assurance authorities to demonstrate product compliance.
• Apply MOD Secure by Design principles throughout the engineering lifecycle.
• Work with external security authorities, including the NCSC, to support assurance of security solutions.
• Advise engineering teams on platform lockdown, configuration and appropriate product security controls.
• Support penetration testing, analyse findings and develop appropriate remediation plans.
• Manage through-life security activities including vulnerability management, patch management and obsolescence planning.
• Support security incident and crisis management activities.
• Review and contribute to Product Security policies and deliver security guidance and training to engineering teams.
• Support bids and proposals through the production of Security Management Plans, work package descriptions and cost estimates.

Skills & Experience

• You will ideally have significant experience developing and maintaining bespoke product-based security solutions within Defence, Government, military or similarly complex engineering environments.
• Recent experience of MOD Secure by Design.
• Strong security risk assessment, risk mitigation and technical assurance experience.
• Experience deriving and managing technical security requirements for products or systems.
• Experience producing Security Cases, RMADS and/or comparable security assurance documentation.
• Knowledge of UK MOD and Government security standards and frameworks, including GovS 007, HMG IS1 & IS2 and relevant JSPs.
• Knowledge of frameworks including NIST SP800-30/37/53 and ISO 27001.
• Experience working directly with product development and engineering teams.
• Knowledge of current cryptographic technologies and key management systems.
• Understanding of product-specific operating systems, firmware and software security controls.
• Understanding of Model Based Systems Engineering (MBSE) and how Product Security integrates into the engineering process.
• Experience supporting vulnerability management, patching and penetration testing/remediation.
• Excellent communication skills with the ability to influence engineering teams, customers and senior stakeholders.
• A relevant engineering, computing or scientific qualification and professional security membership such as CIISec, ISC2 or ISACA would also be beneficial.

Desirable

• Current DV clearance.
• Common Criteria security evaluation experience.
• NATO security policy, risk management and accreditation experience.
• Knowledge of threat intelligence sources.
• Knowledge of quantum cryptography and quantum key management.
• Experience engaging with UK Government, NCSC or NATO security authorities.