> Markdown version of [/jobs/ext/2159533-lead-product-security-engineer](https://www.wearedevelopers.com/jobs/ext/2159533-lead-product-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Product Security Engineer - **Company:** Morson Group - **Location:** Luton, UK - **Experience:** Expert - **Salary:** £192,400.0 - **Contract:** Temporary contract - **Skills:** Software System Penetration Testing, Cyber Security, Firmware, Key Management, Software Vulnerability Management, Software Security, Patch Management - **Published:** August 21, 2026 - **Apply:** https://www.totaljobs.com/job/lead-product-security-engineer/morson-edge-job107877711 ## About the Role * Significant experience developing and maintaining bespoke product-based security solutions within Defence, Government, military or similarly complex engineering environments. * Recent experience of MOD Secure by Design. * Strong security risk assessment, risk mitigation and technical assurance experience. * Experience deriving and managing technical security requirements for products or systems. * Experience producing Security Cases, RMADS and/or comparable security assurance documentation. * Knowledge of UK MOD and Government security standards and frameworks, including GovS 007, HMG IS1 & IS2 and relevant JSPs. * Knowledge of frameworks including NIST SP800-30/37/53 and ISO 27001. * Experience working directly with product development and engineering teams. * Knowledge of current cryptographic technologies and key management systems. * Understanding of product-specific operating systems, firmware and software security controls. * Understanding of Model Based Systems Engineering (MBSE) and how Product Security integrates into the engineering process. * Experience supporting vulnerability management, patching and penetration testing/remediation. * Excellent communication skills with the ability to influence engineering teams, customers and senior stakeholders. * A relevant engineering, computing or scientific qualification and professional security membership such as CIISec, ISC2 or ISACA would also be beneficial. Desirable * Current DV clearance. * Common Criteria security evaluation experience. * NATO security policy, risk management and accreditation experience. * Knowledge of threat intelligence sources. * Knowledge of quantum cryptography and quantum key management. * Experience engaging with UK Government, NCSC or NATO security authorities. ## Description We are recruiting for experienced Lead Product Security Engineers to support a major organisation within the UK defence sector. The role will take responsibility for security aspects of complex defence products and systems throughout the full engineering lifecycle, from design and development through to verification, maintenance and through-life support. Working closely with product development teams, engineering SMEs, risk owners and security assurance authorities, you will lead security risk and assurance activities, derive product security requirements and ensure appropriate security controls are incorporated into product design. This is a Product/Systems Security Engineering role rather than a corporate IT or enterprise cyber security position., * Undertake security risk assessments and develop risk mitigation plans and gap analyses. * Produce Security Management Plans and security documentation supporting product development and assurance. * Define and derive product security requirements, working directly with engineering teams on their implementation. * Provide security advice throughout product design, development, testing and manufacturing. * Produce technical assurance artefacts including Security Cases, Security Operating Procedures, Testing Security Instructions and Key Management Plans. * Liaise with internal and external security assurance authorities to demonstrate product compliance. * Apply MOD Secure by Design principles throughout the engineering lifecycle. * Work with external security authorities, including the NCSC, to support assurance of security solutions. * Advise engineering teams on platform lockdown, configuration and appropriate product security controls. * Support penetration testing, analyse findings and develop appropriate remediation plans. * Manage through-life security activities including vulnerability management, patch management and obsolescence planning. * Support security incident and crisis management activities. * Review and contribute to Product Security policies and deliver security guidance and training to engineering teams. * Support bids and proposals through the production of Security Management Plans, work package descriptions and cost estimates. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [This Machine Ends Data Breaches](https://www.wearedevelopers.com/videos/574-this-machine-ends-data-breaches) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Playing Pong on a shoulder press machine](https://www.wearedevelopers.com/videos/100140-playing-pong-on-a-shoulder-press-machine) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)