Product Security Engineer

Boeing are seeking a Product Security Engineer (IC3) to join our growing team in Bristol or RAF Lossiemouth and help shape the future of integrating security and resiliency on the E-7 Wedgetail platform, plus our wider products and services.

Product security engineering is a cross cutting engineering function and a critical element of designing, delivering, and maintaining Boeing products and services. Our mission is to influence designs and implement security solutions that protect product integrity. You will join a highly energised team committed to staying ahead of evolving cyber threats, developing innovative security measures, consistent standards, practices, and tools.

As a Product Security Engineer (IC3), you will lead development, implementation, and sustainment of product security and resiliency across the requirements, design, build, test, production, operations, and support lifecycle. You will be expected to independently shape technical approaches, influence program level decisions, and provide subject matter expertise to internal and external stakeholders.

You will collaborate with a multidisciplinary, enterprise wide community to create and apply best practices, tools, and solutions that protect complex systems, including IT, embedded, and non IT environments. This role offers the opportunity to solve high impact security challenges, influence next generation security engineering, and directly contribute to the resilience and certification posture of Boeing’s commercial and defence offerings.

Ideal candidates bring deep knowledge and experience in system security, systems engineering, safety/airworthiness, security architecture, and verification/validation activities.

If you are motivated to lead product security initiatives across complex programs and to influence engineering decisions that increase system resilience, we encourage you to apply.

• →Develops and implements product security requirements and architectures to satisfy certification, regulatory, and customer requirements. 
• →Defines security design approaches and leads integration of security features into product architectures and designs. 
• →Conducts and leads cybersecurity risk analysis and threat assessments; evaluates likelihood, impact, and residual risk and determines mitigations. 
• →Performs and leads security assessments, audits, and vulnerability analyses; prepares mitigation strategies and drives remediation actions. 
• →Establishes and sustains security practices across the product lifecycle through coordination with cross‑functional teams and program leadership. 
• →Communicates and documents product security and certification implications, including security consequences of product modifications, to internal stakeholders, suppliers, and customers. 
• →Identifies and defines product security requirements for suppliers of components and subsystems; coordinates supplier security activities and evaluates supplier deliverables for compliance. 
• →Coordinates with governments, customers, suppliers, and industry to identify program risks and to improve industry and regulatory security standards and requirements for programs and interfacing systems. 
• →Independently conducts research and development activities that result in innovative security solutions, tools, or processes; leads pilot implementations and evaluates outcomes. 
• →Performs system analysis and trade studies to define technical concepts, security architectures, and optimal security solutions; documents rationale and recommendations for program decision makers. 
• →Develops and improves team tools, processes, and automation to increase productivity and repeatability across programs. 
• →Leads or contributes to program boards and design reviews: gathers and analyses data, prepares briefings, communicates recommendations, and supports cross‑team decision making. 
• →Monitors emerging threats, vulnerabilities, and security technologies; assesses applicability to programs and recommends prioritized adoption or mitigations. 
• →Ensures security of tools, data, networks, and resources used for product design, development, build, test, storage, delivery, operations, and support. 
• →Responds to program‑level security incidents or findings; coordinates remediation, documents results, and communicates status to stakeholders. 
• →Advises customers and program teams on maintaining product security and certification, including the security consequences of modifying products and services. 

• Demonstrated ability to develop and apply system security concepts across complex systems with minimal supervision. 
• Strong written, verbal communication, and interpersonal skills with experience briefing technical leadership and external customers. 
• Advanced analytical, problem‑solving, and systems‑thinking skills; able to perform trade studies and reason about system‑level risk. 
• Proven experience working collaboratively across multi‑disciplinary teams and influencing technical and program decisions. 
• Skilled at translating complex technical issues into clear, actionable recommendations for technical and non‑technical audiences. 
• Working experience in systems engineering, cybersecurity, systems safety, avionics system development, product security, or systems security engineering. 
• Familiarity with cybersecurity principles, standards, and best practices and demonstrated capability to interpret and apply them to product design and certification. 
• Understanding of requirements definition, subsystem allocation, system architectures, integration frameworks, and integration testing at program scale. 

• Experience defining Concept of Operations (ConOps), system requirements, and use‑case driven security requirements. 
• Broad experience in risk assessment and management, including threat modelling and vulnerability analysis for networked and embedded systems. 
• Experience leading or participating in cybersecurity audits, certification activities, and investigations. 
• Experience with security incident response, root cause analysis, and trend analysis. 
• Familiarity with malware analysis, attack surface reduction, and advanced security analysis techniques. 
• Proven knowledge or hands‑on experience with DevSecOps toolchains and automation. 
• Familiarity with avionics, embedded computing, and communications systems (ARINC series). 
• Proficiency with networking and computing protocols & architectures (TCP/IP, OSI, UDP, serial/parallel communications, bus architectures). 
• Understanding of hardware and software integration processes for safety‑critical platforms. 
• Familiarity with Secure by Design principles and techniques. 

This position does not offer relocation. Candidates must live in the immediate area or relocate at their own expense.