Senior Software Cybersecurity Engineer in Edinburgh

Company Overview

At Motorola Solutions, we believe that everything starts with our people. We’re a global close-knit community, united by the relentless pursuit to help keep people safer everywhere. We build and connect technologies to help protect people, property and places. Our solutions foster the collaboration that’s critical for safer communities, safer schools, safer hospitals, safer businesses, and ultimately, safer nations. Connect with a career that matters, and help us build a safer future.

Department Overview

The Senior Software Cybersecurity Engineer will be responsible for analysing software designs and implementations from a security perspective, identifying and proposing remediations to security issues throughout the software development lifecycle (SDLC).

This role is mainly remote.

Responsibilities

• Security Design and Implementation
  • Perform threat modelling, risk assessments, and architecture reviews to identify and mitigate risk.
  • Support the engineering teams on definition of detailed security requirements to meet compliance requirements and industry best practices.
  • Perform security code reviews looking for potential security vulnerabilities.
  • Act as a subject matter expert to advise and answer questions from engineering and compliance teams on technical product security matters.
• Security Testing
  • Define and oversee the deployment of Software Composition Analysis (SCA) tools to compile SBOMs of software components, helping to identify known vulnerabilities and license compliance violations.
  • Define and oversee the deployment of automated security testing tools into CI pipelines, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Secret Detection scanning tools.
  • Manual penetration testing of web applications (backend and frontend).
  • Write custom scripts or unit test cases to check for vulnerabilities or broken/missing security controls.
  • Recommend improvements to existing security scanning tools and processes, and propose new ones.
• Vulnerability Management
  • Periodically triage the findings from the automated security scanning tools.
  • Validate potential security vulnerabilities to determine whether they are actual true positives, or false positives in the product context.
  • Assess the risk of vulnerabilities and threats in order to help the business determine their remediation priority order.
  • Communicate the identified security issues to engineering and compliance stakeholders, and manage them throughout the SDLC process to ensure they are properly addressed.
• SDLC and DevSecOps Integration
  • Establish and maintain secure coding standards, baseline product security requirements and more general best practices to provide guidance to development teams.
  • Assist the program area with implementing a secure Continuous Integration/Continuous Delivery (CI/CD) pipeline utilizing DevSecOps principles and practices to increase automation.
  • Implement automated security controls as part of CI/CD pipelines.
• Incident Response and Compliance
  • Support product security incident response processes, including root cause analysis and definition of mitigation strategies.
  • Define clear criteria and protocols for security incident response.
  • Conduct post-incident analysis to compile lists of lessons learned, and measures to prevent similar incidents from reoccurring.
  • Monitor emerging security threats, vulnerabilities, and trends to proactively investigate, remediate, and integrate new protections.
  • Ensure products comply with relevant security standards, certifications, and regulations.

Basic Requirements

• Required Qualifications
  • 7+ years of experience in Security Engineering with a focus on product security and/or application security.
  • Bachelor’s degree in Computer Science, Information Security, or a related technical field.
  • Experience leading cybersecurity process change and mentoring on secure by design principles.
  • Partnering with engineering teams to ensure secure coding practices and adoption of industry best practices.
• Technical Skills
  • In-depth knowledge of Linux and Docker container-based infrastructures.
  • Significant software development experience.
  • Proven experience in developing and implementing threat modelling programs.
  • Strong knowledge of security principles, best practices, and industry standards.
  • Experience implementing DAST, SAST, IAST, SCA and driving adherence.
  • Experience with cloud-based infrastructure and securing cloud environments.

Desirable Qualifications

• Familiarity with security considerations for AI/ML systems.
• Understanding of distributed systems design, implementation and operation.
• Exploit development experience.

Education and Certifications

• Master's degree or equivalent experience preferred.
• Security certifications are a plus.

Soft Skills and Leadership

• Excellent verbal and written communication.
• Demonstrated ability to design, document, and implement new security processes.
• Ability to remain calm under pressure.

In return for your expertise, we’ll support you in this new challenge with coaching & development every step of the way. Also, to reward your hard work you’ll get:

• Competitive salary and bonus schemes.
• Two weeks additional pay per year (holiday bonus).
• 25 days holiday entitlement + bank holidays.
• Attractive defined contribution pension scheme.
• Private medical insurance.
• Employee stock purchase plan.
• Flexible working options.
• Life assurance.
• Enhanced maternity and paternity pay.
• Career development support and wide ranging learning opportunities.
• Employee health and wellbeing support.
• Carbon neutral initiatives/goals.
• Corporate social responsibility initiatives.

Travel Requirements

Under 10%

Relocation Provided

None

Position Type

Experienced

Referral Payment Plan

Yes

Company

Motorola Solutions UK Limited

EEO Statement

Motorola Solutions is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion or belief, sex, sexual orientation, gender identity, national origin, disability, veteran status or any other legally-protected characteristic.