Product Security Engineer

Product Security Engineer

Luton

6-month contract

Paying up to Circa £93p/h (Inside IR35)

Please note - Due to the nature of the work, you'll be required to hold a high level of UK Security Clearance

Overview: As the Product Security Engineer /Lead security Engineer, you'll take responsibility for all security aspects of product design, development, verification and maintenance through all phases of the product lifecycle.

The role will focus on undertaking security risk assessments, preparing security risk mitigation plans, deriving security requirements and working closely and directly with product development teams to design, implement and maintain appropriate security controls and the production of wider security artefacts.

Responsibilities:

Production of Security Management Plans, work package descriptions and cost estimates in support of product bids, services and proposals.
Undertaking security risk assessments, risk mitigation plans, mitigation gap analysis and preparation of security management documentation for system assurance.
Defining product security requirements, advising development teams on bespoke implementations for product security control implementations and overseeing product development activities.
Liaison with internal and external security assurance authorities to desmontrate product compliance against recognised UK and wider frameworks.
Driving collaborative working with external security authorities such as the NCSC to provide underwriting of security solutions.
Understanding and management of security activities within development, testing and manufacturing environments.
Advising development teams on suitable platform lockdown and configurations, and supporting penetration test activities. Analysing penetration test results and preparation of remedial action plans.
Identify, communicate and drive through life security management, including but not limited to obsolescence planning, vulnerability and patch management for all products within area of responsibility.
Lead security incident management teams during incident/crisis situations in conjunction with Head of Product Security for EW/FCA.
Review, maintain and participate corporate product security policies.
Deliver product security training to project engineering teams.

Essential Skills & Experience

Experience in the development of besoke product-based security solutions for a military and/or commercial products and systems.
Graduate degree in relevant engineering, computing or related scientific discipline, and/or evidence of further professional study.
Full membership of an NCSC recognised professional security body organisation (i.e. CIISec, ISC2 or ISACA).
Recent experience and demonstratable knowledge of live and legacy UK/EU/NATO information security standards and frameworks, including the UK MOD Secure by Design framework, GovS 007, HMG IS1&2, ISO27001, NIST SP800-30/37/53, UK MOD Information Security related JSPs, EU CRA and US DoD information security policies.
Practical experience of producing technical assurance documentation such as Key Management Plans, Testing Security Instructions, Security Operating Procedures and Security Cases.
Knowledge of current cryptographic technologies and key management systems.
Understanding of Model Based System Engineering (MBSE) and how Product Security directly inputs into the process.
Knowledge and understanding of bespoke product-specific Operating Systems, Firmware and Software security controls and how to apply them.
Knowledge of Quantum Cryptography & Quantum Key management.
Experience or knowledge of existing threat intelligence sources.
Knowledge of NATO security policy, risk management and Accreditation.

Disclaimer:

This vacancy is being advertised by either Advanced Resource Managers Limited, Advanced Resource Managers IT Limited or Advanced Resource Managers Engineering Limited ("ARM"). ARM is a specialist talent acquisition and management consultancy. We provide technical contingency recruitment and a portfolio of more complex resource solutions. Our specialist recruitment divisions cover the entire technical arena, including some of the most economically and strategically important industries in the UK and the world today. We will never send your CV without your permission. Where the role is marked as Outside IR35 in the advertisement this is subject to receipt of a final Status Determination Statement from the end Client and may be subject to change