Job Description:

Product Security Analyst

12 month contract

1-2 days per month - Barrow - LA14

£85.40 per hour (Inside IR35)

In this role you'll do work that matters. You'll be part of a team tackling complex challenges, developing innovative solutions and helping to protect the people and places that depend on us.

Whether you're bringing years of experience or looking to take the next step in your career, you'll have the opportunity to work on meaningful projects, collaborate with talented people and develop your skills in an environment where your contribution can make a real difference.

Join us and help shape the future of defence, security and aerospace.

The Principal Product Security Engineer is a senior technical leader within the Product Security team, acting as the focal point for Information Assurance (IA) and Product Security across the PMS domain within the wider platform programme.

Operating within a highly collaborative, multi-disciplinary engineering environment, the role is responsible for defining and delivering security engineering activities in line with the programme Engineering Management Plan and Project Information Assurance Management Plan, ensuring consistency with approved processes, templates and governance.

The Principal Engineer leads the development of security artefacts required to achieve system design maturity and contractually agreed readiness, including Security Cases, risk management activities, and support to design assurance and review gates. They work closely with internal engineering teams, transversal Whole Boat Product Security (WBPSec) stakeholders, and external suppliers to ensure coherent and integrated security outcomes across the platform.

This is a delivery focused, milestone driven role requiring strong systems engineering awareness, stakeholder influence and the ability to apply pragmatic, risk based security solutions within programme constraints.

Typical duties include :

Programme Delivery & Governance

• Define, agree and deliver Product Security engineering activities in line with the programme Engineering Management Plan
• Ensure all security activities are performed in accordance with approved processes, templates and guidance with deviations appropriately controlled
• Act as the primary Product Security SME for PMS within programme working groups (e.g. PMS SWG)

Security Case & Risk Management

• Lead the development of PMS Interim and Final Security Cases across defined programme phases
• Maintain alignment between system-level security artefacts and Whole Boat IA risk management approaches (WBPSec)
• Maintain and manage PMS contributions to the Whole Boat IA Risk Register
• Identify, assess and document IA requirement shortfalls and associated risks

Technical Governance & Communication

• Manage and coordinate IA Technical Queries (TQs) and formal communications in line with programme processes
• Ensure technical outputs consider security classification and handling constraints (e.g. NNPPI, ITAR)
• Operate within defined communication and data management processes (e.g. formal transmittals, controlled repositories, structured workflows)

Planning, Reporting & Performance

• Plan and manage Product Security activities to meet programme milestones and delivery schedules.
• Provide regular reporting into project governance, including:
• Schedule and activity progress
• Risk and opportunity updates
• Key milestone status
• Identify risks to delivery early and support mitigation and recovery planning.

Team & Capability Contribution

• Provide technical leadership and mentoring within the PMS Product Security team.
• Support consistency, quality and repeatability across Product Security outputs.
• Contribute to continuous improvement of Product Security methods, tooling and practices.

Key Accountabilities and Deliverables

The Principal Engineer will be accountable for delivery and support of:

• PMS Interim and Final Security Cases (multi-phase delivery).
• Development and maintenance of the PMS IA/Security Risk Register
• Contributions to the Whole Boat IA Risk Register and associated artefacts.
• IA inputs to PMS Test, Set-to-Work, and verification strategies.
• Management and resolution of supplier IA Technical Queries (TQs).
• Supplier IA/Cyber artefact reviews and assurance outputs.
• Inputs to PMS Formal Design Reviews, FDP/FTP Groups, and lifecycle review gates.
• PMS IA requirement capture, validation and gap analysis outputs.
• Contributions to PMS IA process development and continuous improvement activities.
• Monthly project review inputs, including progress, risks, issues and milestone tracking.

Knowledge:

• Strong understanding of Information Assurance and Product Security within complex engineered systems
• Possesses and understanding of Secure by Design concept versus Security Accreditation process
• Experience within large scale, highly regulated programmes (e.g. defence, maritime, aerospace)
• Working knowledge of systems engineering lifecycle and design assurance processes
• Proven experience delivering security cases and managing information risk
• Experience engaging with and assuring supplier deliverables
• Awareness of Whole Boat/ Platform level security integration approaches (desirable)

• Awareness and knowledge of the application of HM Government Information Security Standards IS 1 & 2 to complex products
• Awareness and knowledge of the application of ISO 27000 series of Standards to complex products
• Awareness and knowledge of the application of IEC 62443 series of Standards to complex products
• Familiarity with Security Technical Security Testing scoping and test specification