Cybersecurity Engineer, Product Cybersecurity

Wabtec•Erie, PA

75d•$91,000 - $129,800

About The Position

The Cybersecurity Engineer conducts ongoing cybersecurity assessments of Wabtec products to determine compliance with applicable company standards and technical controls. The role advises product managers and engineering teams, promotes awareness of cybersecurity requirements, and recommends practices for meeting those requirements across products offered or made available to customers. It works with others to define and maintain technical controls that address external standards, Wabtec standards, and product requirements, with a focus on web and embedded systems. The position provides product cybersecurity engineering support throughout the software development lifecycle, including threat modeling, risk assessment, security architecture review, secure product design, embedded and IoT security, and cybersecurity compliance. It also supports vulnerability remediation, incident response, security training, and continuous improvement of cybersecurity practices across product teams and portfolios.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, or a related field.
8–10 years of experience in the design, development, and testing of web-based, embedded, and/or connected systems.
At least 4 years of hands-on experience in product or application cybersecurity engineering, architecture, risk assessment, or risk management.
Hands-on experience with security risk assessment methodologies, techniques, and tools, including threat modeling, attack surface analysis, vulnerability assessments, and security testing.
Experience applying cybersecurity frameworks, regulations, and standards such as IEC 62443, NIST 800-53, NIST Cybersecurity Framework, ISO/IEC 27001, or equivalents.
Experience with secure product development processes and DevSecOps practices.
Experience in security architecture and implementing cryptographic technologies, including PKI, secure boot, key management, certificate lifecycle management, and secure communications.
Ability to work independently and manage multiple priorities in a global, matrixed organization.
Strong analytical, organizational, and problem-solving skills.
Excellent verbal, written, presentation, and stakeholder management skills.
Ability to manage multiple tasks while collaborating with diverse stakeholders in an international environment.
Ability to influence technical decisions and drive cybersecurity improvements across global teams and external partners.
Strong collaboration skills with engineering, product management, customers, suppliers, and leadership teams.
Commitment to continuous improvement, operational excellence, and cybersecurity maturity.
Current knowledge of evolving cybersecurity threats, technologies, and industry trends.
The role focuses on product cybersecurity engineering; candidates whose experience is primarily in IT Security, SOC, Information Security, Network Security, Data Security, GRC, or Penetration Testing may not be a suitable match.

Nice To Haves

Experience in industrial sectors such as rail, transportation, mining, automotive, manufacturing, or critical infrastructure.

Responsibilities

Conduct cybersecurity reviews and assessments of Wabtec products throughout the SDLC, evaluating compliance with company policies, standards, and technical controls.
Partner with engineering teams on threat modeling, threat and risk assessments, and security analyses to identify vulnerabilities, attack vectors, and product threat surfaces.
Advise technical and non-technical stakeholders on cybersecurity principles, technologies, and risk management.
Support cybersecurity consulting across connected products, web services, industrial systems, and embedded product portfolios.
Recommend secure design principles, software security controls, hardening strategies, and risk mitigation measures.
Help engineering teams investigate cybersecurity defects, perform root cause analyses, and implement corrective and preventive actions.
Develop and deliver cybersecurity training and awareness programs.
Contribute to developing, documenting, and improving cybersecurity standards, procedures, technical controls, and best practices.
Promote cybersecurity best practices to improve product security maturity and consistency across the organization.
Collaborate with product development teams to integrate cybersecurity requirements into product architectures, designs, and development processes.
Support vulnerability disclosure, remediation planning, and product cybersecurity incident response.
Perform other duties and special projects as assigned.