Social network you want to login/join with:
Lead Product Security Engineer, Southampton
Client:
Leonardo
Location:
Southampton, United Kingdom
Job Category:
-
EU work permit required:
Yes
Job Reference:
1df54b6f822a
Job Views:
91
Posted:
22.01.2025
Expiry Date:
08.03.2025
Job Description:
Job Description:
At Leonardo, we have a fantastic opportunity for a Lead Product Security Engineer to join our team within the Customer Support and Service Solutions (CS3) line of business. CS3 operates across the UK, providing innovative and invaluable support solutions to our customers. We help to ensure the availability of front-line capability wherever and whenever required.
We are looking for an experienced security engineer with expertise in developing and maintaining product security management systems for defence and government customers. The Lead Product Security Engineer will be responsible for all security aspects of product design, development, verification and maintenance of this range of products through all phases of their lifecycle, including completion of key security related planning, assessment, risk mitigation and accreditation activities. It will also involve working closely with product development teams to design, implement and maintain appropriate security controls, providing technical advice within the specialist area of product security.
* Work with customer security accreditors and SMEs as well as project engineering teams to ensure product compliance with customer and company security policies and that any residual security risks are defined and managed.
* Production of Security Management Plans, work package descriptions and cost estimates in support of product bids, services and proposals.
* Undertake security risk assessments, create risk mitigation plans, perform mitigation gap analysis and prepare security management documentation for system accreditation.
* Define product security requirements, advising development teams on suitable implementation standards and techniques and overseeing product development activities.
* Liaise with Security Accreditors and Security Assurance Coordinators in support of security accreditation.
* Prepare Protection Profiles, Security Targets and Evaluation Management Plans, and liaise with NCSC and commercial evaluation teams in support of evaluation activities.
* Advise development teams on suitable platform lockdown and configurations, and support Penetration test activities. Analyse penetration test results and preparation of remedial action plans.
* Prepare and implement through life support and maintenance for product security including vulnerability and patch management plans.
* Lead security incident management teams during incident/crisis situations in conjunction with the Chief Product Security Engineer.
* Support the review and maintenance of corporate product security policies, processes and ways of working, including recommending improvements where appropriate.
* Deliver product security training to project engineering teams.
* Experience in the development of security solutions for military and/or commercial products and systems.
* Registered NCSC certified professional at senior level or above, or NCSC recognised qualification, e.g. ISC Certified Information System Security Professional.
* Knowledge of UK/NATO Information Assurance standards, procedures and systems, including Government Functional Standard GovS 007: Security, HMG IS1&2, ISO27000 series standards, NIST SP800 series standards, JSP440, JSP604, guidance material provided by NCSC, CPNI and NIST.
* Practical experience of producing Security Accreditation documentation.
* Practical experience of NCSC and Common Criteria security evaluation techniques.
* Knowledge of current crypto technologies and key management systems.
* Model Based System Engineering (MBSE) knowledge.
* Understanding of operating systems, firmware and software security controls and how to apply them.
* Understanding of existing, current and
#J-18808-Ljbffr