Chief Product Security Engineer

Job Description:

The Opportunity

At Leonardo, we have a fantastic opportunity for a Chief Product Security Engineer to join our team within the Customer Support and Service Solutions (CS3) line of business. CS3 operates across the UK, providing innovative and invaluable support solutions to our customers, development and production of products and coordination of product integration projects to our international customers.  We help to ensure the availability of front-line capability wherever and whenever required.

We are looking for an experienced Product security practitioner with expertise in developing and maintaining robust Product security management systems for defence and government customers, covering tangible products and their associated support services.

Within CS3, the term product can be used to include both in-service equipment, and the support solutions/services provided to customers, which in themselves are developed. The Chief Product Security Engineer will take responsibility for ensuring that all security aspects of the product design, development, verification and maintenance of this range of products, through all phases of their lifecycle, have been completed in accordance with policy and process. They will work closely with the product development teams to provide guidance in the product design, implementation and maintenance of appropriate security controls.

What you’ll do as a Chief Product Security Engineer:

• Provide security advice and support to product development teams, including in terms of:
  • Deriving Product design, manufacturing and support security requirements
  • Undertaking security risk assessments for Products
  • Preparing Product security risk mitigation plans
  • Review and approval of Security Management plans
•  Security policy maintenance and monitoring
• Production of LoB security metrics
• Management of attendance at external security forums, including liaison with Product Security Accreditors and Product Security Assurance Coordinators.
• Attendance and support to the internal Security Special Interest Group to develop product development security policy.
• Advise development teams on suitable product or platform lockdown and configurations, and support Penetration test activities. Analyse penetration test results and preparation of remedial action plans.
• Coordinate and manage delivery of training on Product security to project engineering teams.
• Lead security incident management teams during incident/crisis situations in conjunction with the Lead Product Security Engineer(s)

The Chief Product Security Engineer has delegated authority within the independent Design Integrity function, responsible for the following elements:

• Security process maintenance and monitoring
• Security competence framework maintenance and monitoring
• Assessment of security competence in line with the competency framework
• Chair and maintenance of a Line of Business security Community of Interest (CoI)
• Promoting and sharing knowledge and best practice across the division to improve product security awareness and help embed it within ways of working
• Training the engineering teams with respect to the security framework, policies and processes

We would like to hear from you if you have a combination of the following:

• Demonstrated experience of developing robust security risk management systems for a range of pan domain products and services in accordance with customer, regulatory and legislative expectations.
• Familiarity with Legislation – e.g. IPA, DPA, Official Secrets Act
• Registered NCSC Certified Professional at lead level, or equivalent NCSC recognised qualification.
• Knowledge of UK/NATO Information Assurance standards, procedures & systems, including HMG Security Policy Framework, ISO security standards, RTCA DO326A.
• Familiarity with the principles of incident investigation and knows how to implement an investigation process.
• Practical experience of NCSC and Common Criteria security evaluation techniques and requirements up to High Grade.
• Knowledge of current Crypto technologies, Key Management Systems & practical COMSEC implementations.
• Experience of identifying the future Product Security needs of the company, regularly delivering training courses within a corporate environment and delivering awareness presentations to other groups.
• Awareness of product security implications relating to safety
• Excellent communication and interpersonal skills, with the ability to interact with a number of stakeholders from subject matter experts to senior leaders, regarding a wide range of technical and operational topics.
• Good understanding and experience in delivery and maintenance of products to meet regulatory requirements, for example MAA DAOS, ARP4754
• Understanding of the concept of operations for products, in order to understand the functional security risks and define/agree the appropriate mitigations
• Ability to identify and deliver alternative/innovative ways to manage security, including ensuring buy-in from key regulatory bodies
• Understanding of the role of advisory boards within the UK Government or NATO for security.
• Active membership of an external security specialist group or forum

Security Clearance

You must be eligible for full security clearance.  For more information and guidance please visit : https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels

Life at Leonardo

With a company funded benefits package, a commitment to learning and development, and a flexible approach to working hours focused on the needs of both our employees and customers, a career with Leonardo has never offered as many opportunities or been more accessible to as many people.

• Flexible Working: Flexible hours with hybrid working options. For part time opportunities, please talk to us
• Company funded flexible benefits: Access to private healthcare, dental schemes, Workplace ISA, Go Green Car Scheme, technology and lifestyle options (£500 annual allowance)
• Holidays: 25 days plus bank holidays, option to buy/sell leave and to accrue up to 12 additional flexi leave days per year
• Pension: Award winning pension scheme (up to 15% employer contribution)
• Wellbeing: Employee Assistance Programme with access to free mental health support, financial wellbeing support and network groups to demonstrate our ongoing commitment to diversity & inclusion (Enable, Pride, Equalise, Armed Forces, Carers, Wellbeing and Ethnicity)
• Lifestyle:  Discounted Gym membership, Cycle to work scheme
• Training: Free access to more than 4000 online courses via Coursera and Linkedin Learning
• Referral Incentive: You can earn a reward for successfully referring a friend or family member
• Bonus: Scheme in place for all employees at management level and below 

For a full list of our company benefits, please visit our website here.

Leonardo is a global high-tech company and one of the key players in Aerospace, Defence and Security. Headquartered in Italy, Leonardo has over 45,000 employees, of which 8,000 are based at 8 sites throughout the UK.

At Leonardo UK, we believe that a diverse and inclusive work environment unlocks our people’s full potential and drives innovation and creativity. We work hard to offer a welcoming, accessible and inclusive place to work for all of our people, creating a culture where everyone can thrive, feel safe and have a sense of belonging and connection.

This is a great opportunity to bring your talents and form an integral part of Leonardo’s future. We can help you develop your skills and offer great opportunities to develop and grow, so why not join us.

Primary Location:

GB - Bristol - Coldharbour Lane

Additional Locations:

GB - Basildon, GB - Edinburgh, GB - Lincoln, GB - Luton - Cap. Green 300, GB - Newcastle, GB - Southampton

Contract Type:

Hybrid Working:

Hybrid