Cyber Security Specialist

Job description

**Core Responsibilities:-** **1. Risk Management & Compliance Governance:-** - TARA Process Management: Conduct comprehensive Threat Analysis and Risk Assessments (TARA) in accordance with ISO 21434 to identify attack surfaces, evaluate threat scenarios, and determine risk levels for connected platforms. - Regulatory Compliance (UNR 155 / UNR 156): Establish, audit, and maintain processes for the corporate Cybersecurity Management System (CSMS) and Software Update Management System (SUMS) to achieve vehicle type approvals and strict regulatory compliance. - Framework Mapping: Align corporate IT security practices (ISO 27001/2) with OT security baselines (IEC 62443 / ISO 21434), ensuring seamless security governance across the entire organization. **2. OT & Embedded Architecture Security:-** - Network Segmentation: Design, review, and enforce secure network zoning and boundaries using the Purdue Model for Industrial Control Systems (ICS) to safely isolate corporate IT from critical shop-floor/on-board OT domains. - Firmware & Software Integrity: Validate secure Over-the-Air (OTA) software update workflows to verify code signing, cryptography standards, and non-repudiation in compliance with UNR 156. - Vulnerability Lifecycle Management: Track, analyze, and triage software/hardware vulnerabilities (CVEs) targeting both enterprise IT systems and industrial/embedded components. **3. Incident Response & Operations:-** - Cross-Domain Monitoring: Monitor security events across both the IT enterprise environment and the Vehicle Security Operations Center (VSOC) or industrial OT monitoring tools. - Incident Handling: Develop and test incident response playbooks tailored for OT environments where uptime and physical safety are critical priorities. - Technical Skills & Qualifications - Required Framework & Standard Expertise - ISO/SAE 21434: Deep operational understanding of automotive cybersecurity engineering, lifecycle management, and work product documentation. - UNECE Regulations (UNR 155 & UNR 156): Direct experience preparing audit evidence, handling type-approval prerequisites, and maintaining compliance for CSMS and SUMS. - The Purdue Model: Absolute mastery of dividing industrial/embedded environments into logical security zones (Levels 0 through 5) to minimize lateral threat movement. - ISO/IEC 27001 / 27002: Strong foundation in corporate information security management systems, asset management, and access control policies. - Risk Methodologies: Proficiency in structured risk assessment models (e.g., E-Attack Trees, STRIDE, NIST SP 800-30). - Software & Technical Skills - Network & Protocols: Strong grasp of both IT protocols (TCP/IP, DNS, HTTP) and OT/Automotive communication paths (CAN bus, Automotive Ethernet, Unified Diagnostic Services (UDS), Modbus, Profinet). - Security Testing: Experience with vulnerability scanning, penetration testing basics, and software fuzz testing tools. - Tools: Familiarity with TARA tooling, SIEM/VSOC platforms, and configuration management databases. **4.Experience & Soft Skills:-** - Experience: 5 to 7 years of dedicated experience working in a dual IT/OT cybersecurity role, Product Security, or Automotive Cyber Engineering. - Communication: Exceptional ability to translate complex, technical OT risks into high-level business risks for IT stakeholders, and vice versa. - Problem Solving: A proven track record of resolving security challenges without disrupting production lines, critical uptime requirements, or safety protocols.