We are seeking an exceptionally skilled and experienced Advanced Cyber Sec Archt/Engr to provide expert-level leadership in product security for embedded and cloud-deployed applications at Sparta Systems. In this critical role, you will drive secure architecture by design, manage product risk, ensure regulatory compliance, and foster a culture of security throughout the development lifecycle, directly impacting the safety and security of our advanced technology solutions.
Roles and Responsibilities:
- Lead efforts with development teams to manage product risk and apply appropriate security controls.
- Drive secure architecture by design, perform comprehensive security risk assessments, and apply a defense-in-depth approach with multi-layered security controls.
- Identify security gaps and define effective remediation approaches using security controls during risk assessments.
- Conduct threat modeling for both embedded products and web applications, effectively communicating security risks to program teams in advance.
- Provide security architecture guidance and support to a large development organization to promote security-by-design principles.
- Drive best-in-class security requirements into product and service offerings and provide architecture and best practices guidance for building secure products.
- Support product security processes such as threat modeling, security requirements definition, security reviews, threat vulnerability assessments, and risk management for aerospace applications.
- Ensure a strong background in product architecture and development with Secure Software Development Lifecycle (SDLC) experience.
- Remain up-to-date on emerging security threats and exploitation techniques.
- Develop, secure, and drive security requirements for Embedded & IIoT-based Avionics Products on RTOS platforms such as VxWorks and Deos.
- Secure Commercial Cloud, Hybrid, and Private cloud-deployed applications, including Containers and VMs, through secure configurations and periodic security reviews.
- Lead efforts in mentoring and training the engineering development community and facilitate the adoption of shift-left security practices.
- Lead new initiatives to add value to Secure Software Development Lifecycle (SDL) processes and procedures.
- Ensure a good understanding of design objectives such as DO-178B/C, DO-326A, DO-355, and DO-356A to support continuous airworthiness of aircraft from safety and security perspectives.
- Contribute to certifying and meeting compliance for embedded products used in aircraft cockpits with certifying authorities like FAA and EASA.
Skills Requirement:
- Expertise in threat modeling of both embedded products and web applications.
- Background in product architecture and development with Secure Software Development Lifecycle (SDLC) experience.
- Strong understanding of security by design principles.
- Experience in developing, securing, and driving security requirements for Embedded & IIoT-based Avionics Products on RTOS platforms such as VxWorks and Deos.
- Experience with securing Commercial Cloud, Hybrid, and Private cloud-deployed applications, including Containers and VMs.
- Strong interpersonal skills with the ability to facilitate diverse groups, negotiate priorities, and resolve conflicts among stakeholders.
- Understanding of Agile software development practices.
- Familiarity with DevSecOps and CI/CD pipelines with specific tooling for security.
- Experience with widely used security tools such as SD Elements, BlackDuck Hub, Microsoft Threat Modeling Tool, SAST (e.g., Coverity, SonarQube), DAST (e.g., Burp, ZAP, AppSpider), Fuzzing, Vulnerability management, and continuous monitoring tools.
- Sound understanding of Cryptography, encryption algorithms, Public Key Infrastructure (PKI), Secure Boot, and Open-source risk management.
- Strong leadership and team-building skills, with the ability to manage stakeholders across business verticals and regions.
- Effective communication skills, excellent relationship management skills, and strong analytical, decision-making, and problem-solving skills.
- A firm believer in continuous learning, upskilling the team on new-age skills, and developing capabilities for new technologies.
QUALIFICATION:
- Bachelor's degree or equivalent work experience in Cyber Security or Information Technology.
- Information Security accreditation (e.g., CISSP, CSSLP, or other security-related certifications) is valued.
- Cloud Security or Solutions Architecture certifications for Azure, AWS, or GCP are valued.
