Software Cybersecurity Engineer

The role focuses on strengthening the cybersecurity posture of energy management and locomotive control products throughout the software development lifecycle. The selected candidate will collaborate with software developers, systems engineers, cybersecurity leadership, and program teams to identify security risks, maintain compliance documentation, coordinate vulnerability remediation, and integrate security best practices into product development., * Support cybersecurity activities throughout the software development lifecycle (SDLC).

• Prepare, coordinate, and maintain Cybersecurity Assurance Technical Output (CATO) documentation and supporting evidence packages.
• Perform and track vulnerability assessments, security scans, and remediation activities using Polaris, Black Duck, and other approved security tools.
• Review software architectures, technical designs, and requirements to identify cybersecurity risks and compliance gaps.
• Assist with threat modeling, risk assessments, and security impact analyses.
• Track cybersecurity findings and work with engineering teams to ensure timely mitigation and closure.
• Support compliance with applicable cybersecurity standards, customer requirements, and internal security policies.
• Assist with cybersecurity audits, technical reviews, and compliance readiness assessments.
• Develop and maintain cybersecurity metrics, dashboards, and project status reports.
• Provide guidance on secure C++ coding practices, vulnerability remediation, and software security best practices.
• Collaborate with cross-functional teams to incorporate cybersecurity requirements into product design, development, testing, and release processes.
• Support continuous improvement of cybersecurity processes, documentation, and security controls.

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Software Engineering, Computer Engineering, or a related technical discipline.
• Experience supporting cybersecurity initiatives in software development, embedded systems, or industrial control environments.
• Hands-on experience with security scanning, vulnerability analysis, or software security assessment tools.
• Understanding of cybersecurity frameworks, industry standards, and compliance requirements.
• Knowledge of vulnerability management, threat modeling, risk assessment, and the Secure Software Development Lifecycle (SSDLC).
• Understanding of cybersecurity compliance, governance, and risk mitigation practices.
• Strong technical documentation, analytical, and communication skills.
• Ability to work independently and collaborate effectively with software engineering and cross-functional teams., * Experience with Polaris, Coverity, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), or Software Composition Analysis (SCA) tools.
• Familiarity with embedded C++ software and Real-Time Operating Systems (RTOS), particularly QNX Neutrino.
• Experience maintaining cybersecurity documentation and supporting product security compliance programs.
• Knowledge of DevOps/DevSecOps methodologies and security integration within CI/CD pipelines.
• Experience with GitLab, Jenkins, and associated security automation tools.
• Familiarity with the IBM Engineering Lifecycle Management (ELM) tool suite.
• Relevant cybersecurity certifications, such as Security+, CISSP, GSEC, SSCP, or equivalent.
• Experience in rail transportation, industrial automation, locomotive systems, or other safety-critical environments.
• Knowledge of cybersecurity standards and frameworks, including:
• IEC 62443
• NIST Cybersecurity Framework
• NIST SP 800-53

Ideal Candidate

The ideal candidate combines practical software cybersecurity knowledge with strong documentation and compliance skills. Experience with vulnerability scanning, secure development practices, embedded systems, and cybersecurity standards in industrial or safety-critical environments will be especially valuable.