Product Security Engineer in HVDC Digital R&D

We are looking for a Product Security Engineer that will help pave the way for our digital platforms.

As Product Security Engineer you will be expected to facilitate the realization of cyber security controls and management functions for the control system product by participating in the R&D process, evaluation of security controls, security assessments of our releases and verification of the selected security controls. The job also entails development/maintenance of documents related to the cyber security domain, like design, functional, test, end-user and marketing documentation, etc.

You will be working in an agile team setup in a Global Environment, with colleagues in Poland that is cooperating with teams in India and Sweden. You will report to the local department but also to the Global R&D functions for digital solutions in HVDC.

The team is working in an agile way where all team members are expected to contribute with their knowledge and experiences to achieve the common goals for the development of the products. This means that the team is doing breakdown of activities together, collaborate within the team as well as seeking collaboration with other relevant teams in (and sometimes outside) the HVDC organization.

Your responsibilities:

• Evaluate the cybersecurity functionalities of the product and improve its security posture.
• Perform threat modeling and security assessments for products.
• Conduct product hardening to allow only necessary functions for product operation.
• Verify cybersecurity functionality on control system components.
• Participate in vulnerability handling of the products.
• Monitor and validate third-party security patches to ensure system reliability is maintained.
• Align with Hitachi Energy internal cybersecurity and IEC 62443-4-1 standards.
• Assess our current cloud security and propose improvements or solutions.
• Review our architecture and design through a security lens to provide actionable, timely requirements and recommendations.
• Assess the infrastructure against different security regulatory, industry and internal standards and identify and implement the necessary security architecture requirements.

Your background:

• Bachelor's or Master's degree in any engineering field; a degree related to cybersecurity is an added advantage.
• Fluent English.
• Good understanding of cybersecurity principles such as cybersecurity architecture, defense in depth, default deny, least privilege, compartmentalization, privileged initiation, AAA (authentication, authorization, accounting), etc.
• Good understanding of cybersecurity controls like IDS/IPS (host and network), hardening, security policies, malware protection, filtering, NGFW (Next-Generation Firewall), etc.
• Good understanding of performing threat modeling and design reviews to assess security implications and requirements for introduction of new technologies.
• Working with service-oriented architecture/ micro services architect for cloud-based services.
• Understanding of cloud security and governance tools.
• Hands-on experience with protocols like HTTP, HTTPS, SSL, SSH, ICMP, DHCP, L2TP, PPTP, DNS, SNMP, RDP, and NTP.
• Knowledge of security standards like IEC 62443.
• Knowledge in networking, patch management, industrial protocols like DNP/MODBUS/IEC 61850 etc.
• Certifications like MCP/MCITP/MCSE/CEH/CISSP are an advantage.

Soft skills:

• Strong communication and collaboration skills required
• Good intercultural sensitivity
• Strong leadership skills
• Training skills

Apply now