Product Security Specialist

Conduct and facilitate Threat and Risk Analyses (TRA) together with the engineers, including the creation and maintenance of the associated artifacts. Assess vulnerabilities (vulnerability assessment) and derive and evaluate suitable countermeasures in terms of effectiveness, effort, and residual risk. Evaluate the CRA compliance of our products and document conformity in a structured and traceable manner. Create and maintain the technical documentation required under the CRA (including risk assessment, SBOM, and conformity evidence). Contribute to vulnerability and patch management across the product lifecycle, including the coordinated vulnerability disclosure process and reporting obligations. Support security-by-design and the secure development lifecycle (SDLC) in product development. Act as an interface to functional safety, quality, and product management; advise engineering teams on security matters. Prepare for and accompany audits and conformity assessments with internal and external bodies.

You work closely with our engineering teams and bring security methodology into the development of mission-critical computing platforms for the rail and transportation industry.

• Degree in computer science, electrical engineering, cyber security, or a comparable field

• At least two years of professional experience in product or embedded security

• Sound knowledge of threat modeling and risk analysis (e.g., STRIDE, attack-tree methods) and of vulnerability assessment (CVSS, SCA)

• Experience with relevant standards and regulations, in particular the Cyber Resilience Act and IEC 62443; rail context (TS 50701 / EN 50701, IEC 63452) is an advantage

• Understanding of embedded systems, network and communication protocols, and secure software architectures

• Experience with TRA documentation, tools for vulnerability tracking, and SBOM generation

• Structured, diligent way of working and the ability to document technical matters clearly

• Very good English skills; strong communication skills for collaboration with interdisciplinary teams