Job Description:
At Leonardo, we have a fantastic opportunity for a Lead Product Security Engineer to join our team within the Customer Support and Service Solutions (CS3) line of business. CS3 operates across the UK, providing innovative and invaluable support solutions to our customers. We help to ensure the availability of front-line capability wherever and whenever required.
We are looking for an experienced security engineer with expertise in developing and maintaining product security management systems for defence and government customers. Within CS3, the term product can be used to include both in-service equipment, and the support solutions/services provided to customers, which in themselves are developed. The Lead Product Security Engineer will be responsible for all security aspects of product design, development, verification and maintenance of this range of products through all phases of their lifecycle, including completion of key security related planning, assessment, risk mitigation and accreditation activities. It will also involve working closely with product development teams to design, implement and maintain appropriate security controls, providing technical advice within the specialist area of product security.
Work with customer security accreditors and SMEs as well as project engineering teams to ensure product compliance with customer and company security policies and that any residual security risks are defined and managed.
Production of Security Managements Plans, work package descriptions and cost estimates in support of product bids, services and proposals.
Undertake security risk assessments, create risk mitigation plans, perform mitigation gap analysis and prepare security management documentation for system accreditation.
Define product security requirements, advising development teams on suitable implementation standards and techniques and overseeing product development activities.
Liaise with Security Accreditors and Security Assurance Coordinators in support of security accreditation.
Prepare Protection Profiles, Security Targets and Evaluation Management Plans, and liaise with NCSC and commercial evaluation teams in support of evaluation activities.
Advise development teams on suitable platform lockdown and configurations, and support Penetration test activities. Analyse penetration test results and preparation of remedial action plans.
Prepare and implement through life support and maintenance for product security including vulnerability and patch management plans
Lead security incident management teams during incident/crisis situations in conjunction with the Chief Product Security Engineer
Support the review and maintenance of corporate product security policies, processes and ways of working, including recommending improvements where appropriate.
Deliver product security training to project engineering teams.
Experience in the development of security solutions for military and/or commercial products and systems.
Registered NCSC certified professional at senior level or above, or NCSC recognised qualification, e.g. ISC Certified Information System Security Professional.
Knowledge of UK/NATO Information Assurance standards, procedures and systems, including Government Functional Standard GovS 007: Security, HMG IS1&2, ISO27000series standards, NIST SP800series standards, JSP440, JSP604, guidance material provided by NCSC, CPNI and NIST.
Practical experience of producing Security Accreditation documentation
Practical experience of NCSC and Common Criteria security evaluation techniques.
Knowledge of current crypto technologies and key management systems
Model Based System Engineering (MBSE) knowledge
Understanding of operating systems, firmware and software security controls and how to apply them.
Understanding of existing, current and emerging technologies including cloud, virtualisation and web-based
Excellent communication and interpersonal skills, with the ability to interact with a range of stakeholders, including development teams, subject matter experts, accreditors and senior leaders.
A positive attitude, with a drive to improve the business, and the ability to influence and motivate others
Experience of working with Enterprise Security Architectures (SABSA, MODAF).
Security Clearance
:
Life at Leonardo
With a company funded benefits package, a commitment to learning and development, and a flexible approach to working hours focused on the needs of both our employees and customers, a career with Leonardo has never offered as many opportunities or been more accessible to as many people.
Flexible Working: Flexible hours with hybrid working options. For part time opportunities, please talk to us
Company funded flexible benefits: Access to private healthcare, dental schemes, Workplace ISA, Go Green Car Scheme, technology and lifestyle options (£500 annual allowance)
Holidays: 25 days plus bank holidays, option to buy/sell leave and to accrue up to 12 additional flexi leave days per year
Pension: Award winning pension scheme (up to 15% employer contribution)
Wellbeing: Employee Assistance Programme with access to free mental health support, financial wellbeing support and network groups to demonstrate our ongoing commitment to diversity & inclusion (Enable, Pride, Equalise, Reservists, Carers)
Lifestyle: Discounted Gym membership, Cycle to work scheme
Training: Free access to more than 4000 online courses via Coursera
Referral Incentive: You can earn a reward for successfully referring a friend or family member
Bonus: Scheme in place for all employees at management level and below
