R&D Product Security Engineer - Digital Service Solutions

Business Unit Service is at the forefront of delivering advanced digital service solutions worldwide. Our Service R&D team focuses on cutting-edge technologies - to innovate in areas of serviceable assets, digital services and operations. As our digital service portfolio and HMAX Energy platform continue to grow, cybersecurity is a critical enabler for trusted, scalable, and compliant service delivery.
Join BU Service R&D to ensure that cybersecurity requirements are systematically embedded into digital service development, from early design through deployment and lifecycle operation.

How you will make an impact

As a Product Security Engineer you will ensure that products adhere to our cybersecurity standards, and you provide technical guidance across the BU Service digital portfolio, acting as a bridge between cybersecurity research, platform development, and operational service needs.

• Define and maintain cybersecurity requirements, principles, and guardrails for BU Service digital solutions, including HMAX Energy-related developments

• Provide cybersecurity oversight during the development of digital services, ensuring security-by-design is applied early and consistently

• Collaborate closely with the BU Service Cybersecurity Lead and central cybersecurity function to ensure alignment with our Cybersecurity Strategy, policies, standards, and regulatory requirements

• Support product teams in identifying cybersecurity risks, translating them into practical mitigation actions, and tracking them to resolution

• Act as a cybersecurity point of contact for Service R&D, connecting upstream research outcomes with downstream service and operational needs

• Previous Experience: 8+ yrs of experience in product security roles in the energy sector or a related field

• Education: MSc / PhD degree in cyber security, Computer Science, Software Engineering, Electrical/Computer Engineering, or a comparable field

• Industrial infrastructure security exposure: Solid understanding of cybersecurity topics relevant to industrial / OT-connected and cloud-connected solutions, and the ability to guide teams on security weaknesses and mitigations.

• Standards & compliance mindset: Familiarity with widely used industrial cybersecurity standards and governance expectations - particularly the IEC 62443 family (e.g., secure development process and component requirements),information security management practices aligned with ISO 27001, NERC CIP and IEC 62351.

• Secure development & lifecycle practices: Working knowledge of secure development lifecycle (SDLC) / security-by-design practices and how to embed them into development workflows.

• Certifications / formal training (preferred):

• Training or demonstrated knowledge aligned to IEC 62443 (e.g., role-relevant training for service providers / maintenance service providers).

• ISO 27001 Lead Auditor/Lead Implementer (or equivalent experience).

• CISSP, CISM, CCSP, GICSP, or equivalent.