Product Security Engineer

Salary: £? - ? per year

Requirements:

• Degree or postgraduate qualification in Engineering, Computer Science, Cyber Security or a related scientific/technical discipline, or equivalent professional experience.
• Demonstrable experience developing product-based security solutions for military, defence, government or commercial products and systems.
• Strong experience in Product Security / Information Security / Cyber Security Engineering.
• Experience undertaking security risk assessments and developing risk mitigation strategies.
• Experience defining and managing product security requirements.
• Experience producing technical security assurance documentation.
• Experience working directly with engineering and product development teams.
• Strong understanding of security throughout the product lifecycle.
• Practical experience with security assurance and compliance activities.
• Knowledge of UK Defence and Government security frameworks.
• Recent experience with relevant UK/EU/NATO information security standards and frameworks, including UK MOD Secure by Design, GovS 007, HMG IS1/IS2, ISO 27001, NIST SP 800-30, 800-37 and 800-53, UK MOD Information Security-related JSPs, EU Cyber Resilience Act (CRA), and US Department of Defense information security policies.
• Experience producing security artefacts such as Key Management Plans, Security Operating Procedures, Security Cases and security testing documentation.
• Knowledge of cryptographic technologies and key management.
• Understanding of Model-Based Systems Engineering (MBSE) and the role of Product Security within the systems engineering lifecycle.
• Understanding of operating system, firmware and software security controls.
• Excellent written and verbal communication skills.
• Strong stakeholder management and influencing skills.
• Ability to work collaboratively with engineering, security and customer stakeholders.
• Active SC Clearance or eligibility for SC clearance with UK Eyes Only requirements.
• Professional membership of an NCSC-recognised security organisation such as CIISec, ISC2 or ISACA.

Responsibilities:

• Develop Security Management Plans, work package descriptions and cost estimates for bids, services and proposals.
• Undertake security risk assessments and develop risk mitigation plans.
• Conduct mitigation gap analysis and produce security management documentation for system assurance.
• Define product security requirements and advise engineering teams on security control implementation.
• Work directly with product development teams throughout the product lifecycle.
• Liaise with internal and external security assurance authorities to demonstrate compliance with relevant security frameworks.
• Work collaboratively with external security authorities, including the NCSC, where required to support security assurance.
• Manage security activities across development, testing and manufacturing environments.
• Advise engineering teams on platform lockdown, secure configuration and security hardening.
• Support penetration testing activities, analyse findings and develop remedial action plans.
• Manage through-life product security, including vulnerability management, patch management and security obsolescence planning.
• Support security incident management and crisis response activities.
• Review and contribute to corporate product security policies and processes.
• Deliver product security training and guidance to engineering teams.
• Produce and maintain technical security artefacts and assurance documentation.

Technologies:

• Firmware
• Incident Management
• Support
• Security
• Cryptography

More:

We are seeking an experienced Product Security Engineer to support the development and maintenance of bespoke security capabilities for Defence and Government customers. This is a highly technical role focused on security risk assessment, security requirements, risk mitigation, security assurance and the implementation of appropriate security controls across the full product lifecycle. You will work closely with product development teams, security assurance authorities, risk owners and engineering SMEs to ensure our products meet relevant customer and organisational security requirements. The role is based in Luton with 90% onsite working, on a 12-month+ contract, and requires active SC clearance, UK Eyes Only / Sole British National status.

last updated 34 week of 2026