Cybersecurity Engineer, Product Cybersecurity

About the role

Wabtec is looking for a Cybersecurity Engineer in Melbourne to carry out ongoing cybersecurity assessments of its products against Wabtec cybersecurity standards and technical controls. The engineer advises product managers and engineering teams, raises awareness of cybersecurity standards and recommends best practices for all Wabtec products offered to customers. The role focuses on product cybersecurity engineering, including threat modeling, security architecture reviews, embedded/IoT security, secure product design and compliance.

Key responsibilities

• Review and assess Wabtec products throughout the SDLC for compliance with Wabtec policies, standards and technical controls
• Partner with engineering teams on threat modeling, threat and risk assessments and security analyses to find vulnerabilities and attack vectors
• Advise on cybersecurity principles, technologies and risk management, and support cybersecurity consulting for connected products, web services and industrial systems
• Recommend secure design principles, hardening strategies and risk mitigation measures
• Help investigate defects, run root cause analyses and implement corrective and preventive actions
• Develop and deliver cybersecurity training and awareness programs
• Contribute to cybersecurity standards, procedures and best practices, and promote them across the organisation
• Integrate cybersecurity requirements into product architectures and development processes, and support vulnerability disclosure, remediation and incident response

Required profile

• Bachelor's degree in Computer Science, Cybersecurity or a related field
• 8-10 years of experience designing, developing and testing web-based, embedded and/or connected systems
• 4+ years of hands-on product/application cybersecurity engineering, architecture, risk assessment or risk management
• Experience with security risk assessment methods and tools, and with frameworks such as IEC 62443, NIST 800-53, NIST CSF and ISO/IEC 27001
• Preferred: industrial sector experience (rail, transportation, mining, automotive, manufacturing, critical infrastructure) and DevSecOps experience
• Ability to work independently in a global, matrixed organisation and to influence technical decisions

Required skills

• Threat modeling, attack surface analysis, vulnerability assessments and security testing
• Cryptographic technologies: PKI, secure boot, key management, certificate lifecycle management and secure communications
• Secure product development and DevSecOps practices

The stated salary range is $91,000-$129,800, depending on experience, education and location. Benefits include health, welfare and retirement options, and possibly an annual bonus.