Product Cybersecurity Engineer

Salary: £60,000 - 90,000 per year

Requirements:

• We require UK right to work without sponsorship.
• We need someone who has personally authored at least two completed TARAs to ISO/SAE 21434, from item definition through to risk treatment decision and residual risk acceptance, on a product that reached production or formal assessment.
• We need fluency in the assessment structure, including damage scenarios, impact rating, threat scenarios, attack paths, attack feasibility, risk determination, and treatment.
• We need experience applying a named attack feasibility approach and the ability to justify it over alternatives.
• We need experience authoring or materially contributing to a cybersecurity case.
• We need embedded and vehicle systems literacy, including ECUs, CAN networks, telematics units, software update paths, and embedded Linux.
• We need experience deriving cybersecurity requirements and passing them to a supplier or integrator, including handling unverifiable third-party platform assumptions.
• We need experience facilitating technical workshops with engineers who were not the requesting party.
• We need assurance-grade written English suitable for audit, assessment, or regulator scrutiny.
• Desirable experience includes UNECE R155, CSM, medini analyze, itemis SECURE, ThreatGet, or comparable tools.
• Desirable experience includes IEC 62443 alongside ISO/SAE 21434.
• Desirable sector experience includes off-highway, agricultural, construction, municipal, or other specialist vehicle sectors.
• Desirable experience includes working knowledge of Yocto/embedded Linux build systems, submission, or audit exposure.
• Desirable experience includes functional safety alongside cybersecurity.
• Desirable awareness of the EU Cyber Resilience Act.

Responsibilities:

• We will rely on you to deliver TARAs to ISO/SAE 21434 for assigned product lines, from item definition and asset identification through to documented risk treatment decisions.
• You will develop derived, testable, and traceable cybersecurity requirements.
• You will define cybersecurity assumptions and interface requirements for third-party platform components.
• You will contribute to the cybersecurity case for assigned product lines.
• You will facilitate technical workshops with client engineering teams and produce written outputs.
• You will work within an established method, templates, governance framework, and client relationship owned by our Product Security Architect.
• You will provide delivery capacity within the existing approach rather than reviewing, re-baselining, or redesigning it.
• Your work will be subject to independent QA before reaching the client.

Technologies:

• Architect
• Embedded
• Support
• Linux
• Security
• Cloud

More:

We are a specialist product cybersecurity consultancy supporting an in-flight EU Cyber Resilience Act conformity programme for a UK manufacturer of specialist commercial vehicles. The role is hybrid and on-site in Surrey for workshops and design sessions. It is an initial 3-month contract with potential to extend to 6 months, with rate to be confirmed based on experience and outside IR35 status to be determined by the engaging consultancy. No security clearance is needed. We are seeking delivery support across five ISO/SAE 21434 threat analysis and risk assessments spanning three product lines, including CAN-based vehicle controllers with 4G telematics and a connected fleet-management product on an embedded Linux platform. The method, templates, governance framework, and client relationship are already in place, and all work is subject to independent QA before it reaches the client.

last updated 31 week of 2026