This role focuses on the ongoing cybersecurity assessments of Wabtec products to ensure compliance with applicable cybersecurity standards and technical controls. The engineer will advise product managers and engineering teams, raise awareness of cybersecurity standards, and recommend best practices for satisfying these standards across all Wabtec products. They will also work closely with others to define and maintain technical controls for external and internal standards, and product requirements.
Responsibilities
Conduct cybersecurity reviews and assessments of Wabtec products throughout the Software Development Lifecycle (SDLC), evaluating compliance with Wabtec policies, standards, and technical controls
Partner with engineering teams to perform threat modeling, threat and risk assessments, and security analyses to identify vulnerabilities, attack vectors, and product threat surface
Provide expert guidance on cybersecurity principles, technologies, and risk management, clearly communicating technical concepts to engineering teams, leadership, and non-technical stakeholders
Support cybersecurity consulting activities across Wabtec's connected products, web service, industrial systems, and embedded product portfolios
Recommend secure design principles, software security controls, hardening strategies, and risk mitigation measures that reduce attack surface while ensuring maintainability and operational efficiency
Support engineering teams in investigating cybersecurity defects, performing root cause analyses, and implementing corrective and preventive actions
Develop and deliver cybersecurity training and awareness programs for engineers, technical leaders, product managers, and business stakeholders
Contribute to the development, documentation, and continuous improvement of cybersecurity standards, procedures, technical controls, and best practices
Promote and share cybersecurity best practices across the organization to improve product security maturity and consistency
Collaborate with product development teams to integrate cybersecurity requirements into product architectures, designs, and development processes
Support vulnerability disclosure, remediation planning, and security incident response activities related to product cybersecurity
Perform other duties and special projects as assigned
Requirements
Bachelor's degree in Computer Science, Cybersecurity, or a related field
8–10 years of experience in the design, development, and testing of web-based, embedded, and/or connected systems
4+ years of hands-on experience in product/application cybersecurity engineering, architecture, risk assessment, or risk management
Hands-on experience with security risk assessment methodologies, techniques, and tools, including threat modeling, attack surface analysis, vulnerability assessments, and security testing
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
Experience applying cybersecurity frameworks, regulations, and standards such as IEC 62443, NIST 800-53, NIST Cybersecurity Framework (CSF), ISO/IEC 27001, or equivalent
Experience with secure product development processes and DevSecOps practices
Experience in security architecture and implementing cryptographic technologies, including PKI, secure boot, key management, certificate lifecycle management, and secure communications
Ability to work independently and effectively manage multiple priorities in a global, matrixed organization
Strong analytical, organizational, and problem-solving skills
Excellent verbal, written, presentation, and stakeholder management skills
Ability to manage multiple tasks while collaborating with diverse stakeholders in an international environment
Proven ability to influence technical decisions and drive cybersecurity improvements across global teams and external partners
Strong collaboration skills with engineering, product management, customers, suppliers, and leadership teams
Demonstrated commitment to continuous improvement, operational excellence, and cybersecurity maturity
Current knowledge of evolving cybersecurity threats, technologies, and industry trends
Nice to have:
Experience in industrial sectors such as rail, transportation, mining, automotive, manufacturing, or critical infrastructure
Benefits
Health, welfare, and retirement benefits
Annual bonus, if eligible
About the Company
Wabtec is a leading global provider of equipment, systems, digital solutions, and value-added services for the freight and transit rail sectors. Drawing on more than 150 years of experience, the company leads the way in safety, efficiency, reliability, innovation, and productivity. With roots dating back to George Westinghouse, Thomas Edison, and Louis Faiveley, Wabtec has always built technologies and implemented solutions for a variety of sectors critical to meeting the needs of customers and governments alike. Its global team of about 30,000 employees worldwide delivers performance that moves the world forward.
Wabtec is a leading supplier of value-added, technology-based products and services for freight rail, passenger transit and select industrial markets worldwide.
