Principal Engineer - Product Security

Principal Engineer - Produsct Security

Filton (Or nearest site)

£83.40p/h Inside IR35

This role requires Active SC clearance from day 1. (No Sponsorship offered)

Role Description
The following activities are typical of the work that may be carried out by the PSA Principal Engineer, in full or part dependent on the role and the place the project is in the engineering life cycle:
Provide advice on Product Security matters for programmes to a wide range of stakeholders which will include System Engineers, Engineering Managers and Technical Authorities as required.
Gain sufficient understanding of a system, its concept of use and architectures in order to provide an accurate assessment of Product Security in terms of possible threats, potential avenues of attack and to advise on the application of secure development practices.
Be able to select appropriate Product Security techniques which are consistent and repeatable for use across a programme.
Understand and be able to provide relevant guidance on the threat environment for a programme.
Ensure that Product Security analysis of a project, system or equipment, is delivered and is managed using recognised risk analysis techniques.
Ensure that Product Security analysis work is fully documented, enabling the management of risk throughout the product life cycle.
Be able to contribute and influence the development of Product Security strategies, policies, guidance, good practices and awareness.
Be able to recommend appropriate controls to mitigate identified risks in line with government and MOD policies and good practice, to provide more cost effective risk mitigation in the longer term.
Present risks and proposed controls to internal and external stakeholders, to achieve agreement and buy-in.
Be able to plan and manage work concurrently across multiple security work programmes.
Provide regular updates on project status/progress in accordance with project specific reporting cycles.
Represent the Product Security group at Design Reviews and other various engagements, to ensure that Product Security is appropriately considered at each stage of the design life cycle.
Undertake peer reviews as directed.
Provide technical guidance and supervision to other Product Security engineers and support the management and planning of specialist activities.
Provide technical guidance and support in relation to product incident management.

Specific Key Accountabilities and Deliverables
The PSA Principal Engineer will be responsible for, or provide input to the following typical key deliverables, dependent on the role and the place the project is in the engineering life cycle:
Risk Management Accreditation Document Set (RMADS).
Security Strategy and other accreditation documentation
Captured and agreed technical requirements in accordance with company and programme processes.
Compliant technical solutions against contractual requirements and regulations.
Technical input and appropriate consideration of product security activities and issues for LCM deliverables and Design Reviews, including Sub-Contract Design Reviews.
Captured and agreed input to appropriate Verification and Qualification Plans.
Specialist advice and contribution to other project documentation, such as Training Needs Analysis (TNA), Technical Publications, Cyber Incident Plans and Operating Instructions (list is not exhaustive).

Experience
Degree (or equivalent experience) in a relevant STEM subject or Information Security related.
Holds NCSC CCP SIRA status (or able to achieve)
Good understanding of information security principles and is able to advise on the potential impact to Product Systems.
Experience of Product Security Engineering activities in the defence, maritime or closely linked domain.
Knowledge of security related activities required to support the engineering life cycle with experience of operating in the phase relevant to the role.
Proven experience of assessing and managing information risk in line with industry good practice.
Experience of assessing and advising on controls to support Product Safety.
Proven experience of applying Product Security/Information Security concepts to applicable technologies within the environment (or similar).