Principal Product Security Engineer

Description

The company's Combat Air Electronic Warfare Design Integrity department is recruiting Principal Product Security Engineers to support product cyber resilience on future aircraft and defence products across all domains.

You will work with multidisciplinary product teams within the Combat Air and Electronic Warfare business area, building security into every stage of the product lifecycle.

The role involves liaising with security specialists, including the head of product security and Product Cyber Resilience Managers, to keep security assurance on track.

The company is a global aerospace, defence and security group headquartered in Italy, with over 53,000 employees worldwide, including 8,500 across 9 UK sites.

This is not an exhaustive list of requirements, and candidates with gaps in some areas are encouraged to apply. A good attitude and willingness to learn matter most.

Responsibilities

• Set product security requirements and advise development teams on suitable standards and techniques.
• Support product development activities.
• Build and maintain security protocols, tools and processes that stay ahead of emerging threats.
• Produce and manage key artefacts, including risk assessments, security cases and remediation action plans.
• Run security assurance across the full product lifecycle so every design is robust, compliant and resilient.
• Help improve the engineering capability on an ongoing basis.
• Take part in the UK-wide Security and IA community, sharing best practice and shaping security strategy.

Requirements

• Practical experience with ISO 27001, ISO 27004, ISO 27005 and/or the NIST Risk Management Framework (RMF).
• Experience supporting a security risk management system for highly regulated products, based on recognised frameworks in defence, aerospace, nuclear, automotive, rail, or oil and gas.
• An understanding of engineering development lifecycles and how product security fits within them.
• Ability to interpret penetration test reports and support remediation work.
• Awareness of UK Government assurance processes, such as the MoD Secure by Design Framework (via JSP 453 and ISN2023/09, or the legacy JSP 604 assurance route) or the CAF GovAssure processes.
• Professional recognition in security governance and risk management, secure system architecture and design, or security assurance and audit, endorsed by a professional information security body such as CIISec, ISC2, ISACA or the UKCSC.
• Security clearance: the role requires pre-employment screening under the UK Government's Baseline Personnel Security Standard (BPSS). Additional National Security Vetting (NSV) may apply, which could include meeting eligibility for the Security Check (SC) or Developed Vetting (DV).

Conditions

Permanent contract.

Hybrid working, based in Luton, with additional locations in Bristol, Lincoln and Southampton.

Flexible hours are available. Part-time working may be possible, so ask about what could work for this role.

Salary is set within a grade-based band. The advertised range reflects the approved grade band or a narrower hiring range within it, benchmarked against the external market. Offers above the standard range go through governance controls.

The company welcomes applications from all backgrounds and will make reasonable adjustments for accessibility during recruitment.

Benefits

• Up to 12 additional flexi-days of annual leave.
• Pension scheme with up to 15% employer contribution.
• Free access to mental health support, financial advice and employee-led networks.
• Bonus scheme open to employees at management level and below.
• Free access to over 4,000 online courses through Coursera and LinkedIn Learning.
• Referral reward for recommending a friend.
• Up to £500 a year in flexible benefits, covering private healthcare, dental, family cover, tech and lifestyle discounts, gym memberships and more.
• A full list of company benefits is available on the company website.