Lead Product Security Engineer in Watford

Lead Product Security Engineer
Location:
Luton – hybrid working Rate:
£92.50 per hour Umbrella Contract:
6 months Clearance:
Active SC required; DV desirable Nationality:
Sole British nationals only due to UK Eyes Only requirements We are recruiting for
experienced Lead Product Security Engineers
to support a major organisation within the UK defence sector. The role will take responsibility for security aspects of complex defence products and systems throughout the full engineering lifecycle, from design and development through to verification, maintenance and through-life support. Working closely with product development teams, engineering SMEs, risk owners and security assurance authorities, you will lead security risk and assurance activities, derive product security requirements and ensure appropriate security controls are incorporated into product design. This is a Product/Systems Security Engineering role rather than a corporate IT or enterprise cyber security position. Key Responsibilities
Undertake security risk assessments and develop risk mitigation plans and gap analyses.
Produce Security Management Plans and security documentation supporting product development and assurance.
Define and derive
product security requirements , working directly with engineering teams on their implementation.
Provide security advice throughout product design, development, testing and manufacturing.
Produce technical assurance artefacts including
Security Cases, Security Operating Procedures, Testing Security Instructions and Key Management Plans .
Liaise with internal and external security assurance authorities to demonstrate product compliance.
Apply
MOD Secure by Design
principles throughout the engineering lifecycle.
Work with external security authorities, including the NCSC, to support assurance of security solutions.
Advise engineering teams on platform lockdown, configuration and appropriate product security controls.
Support penetration testing, analyse findings and develop appropriate remediation plans.
Manage through-life security activities including
vulnerability management, patch management and obsolescence planning .
Support security incident and crisis management activities.
Review and contribute to Product Security policies and deliver security guidance and training to engineering teams.
Support bids and proposals through the production of Security Management Plans, work package descriptions and cost estimates.
Skills & Experience
You will ideally have: Significant experience developing and maintaining
bespoke product-based security solutions
within Defence, Government, military or similarly complex engineering environments.
Recent experience of
MOD Secure by Design .
Strong security risk assessment, risk mitigation and technical assurance experience.
Experience deriving and managing
technical security requirements
for products or systems.
Experience producing Security Cases, RMADS and/or comparable security assurance documentation.
Knowledge of UK MOD and Government security standards and frameworks, including
GovS 007, HMG IS1 & IS2 and relevant JSPs .
Knowledge of frameworks including
NIST SP800-30/37/53 and ISO 27001 .
Experience working directly with product development and engineering teams.
Knowledge of current
cryptographic technologies and key management systems .
Understanding of product-specific operating systems, firmware and software security controls.
Understanding of
Model Based Systems Engineering (MBSE)
and how Product Security integrates into the engineering process.
Experience supporting vulnerability management, patching and penetration testing/remediation.
Excellent communication skills with the ability to influence engineering teams, customers and senior stakeholders.
A relevant engineering, computing or scientific qualification and professional security membership such as
CIISec, ISC2 or ISACA
would also be beneficial. Desirable
Current
DV clearance .
Common Criteria security evaluation experience.
NATO security policy, risk management and accreditation experience.
Knowledge of threat intelligence sources.
Knowledge of quantum cryptography and quantum key management.
Experience engaging with UK Government, NCSC or NATO security authorities.
TPBN1_UKTJ