Software Security Lead - Senior Principal Software Engineer - S3E

RTX•Tucson, AZ

1d•Onsite

About The Position

At RTX, the world's largest aerospace and defense company with 185,000 employees, individuals are united by purpose to solve complex global problems. With three market-leading businesses, world-class operations, and investments in research and development, RTX offers unique capabilities and opportunities. The company focuses on pushing the boundaries of science to connect and protect the world, leveraging over 100 years of experience and engineering expertise to meet current and future defense needs, ensuring a safer, more secure world. The Software Security Sensors and Effectors Department within the Software Product Assurance (SPA) Center is seeking a highly motivated Software Security Lead (SSL) in Tucson, AZ. This role involves collaborating with Systems and Software Architects and program stakeholders to embed software security into program processes and customer deliverables. The SSL will be responsible for capturing and developing security-relevant requirements, considering architectural and design impacts, and ensuring adherence to secure coding practices and Software Product Assurance Command Media. The ideal candidate will apply secure coding principles to design and develop hardened software applications, working individually or as part of a team. This is an onsite position in Tucson, Arizona, due to security clearance requirements.

Requirements

Bachelor’s degree in Science, Technology, Engineering or Mathematics (STEM) and 10 years of related experience
Experience in object-oriented software design and embedded development using languages such as C and or C++
Experience with Xilinx UltaScale+ MPSoC, Versal, or similar Embedded Processors
Experience with embedded OS like VxWorks, Embedded Linux, or similar
Embedded Software Security and Cryptographic Algorithm experience
Experience with Secure Boot concepts
Understanding of secure coding principles, architecture and implementation of secure coding best practices
The ability to obtain and maintain a US security clearance. U.S. citizenship is required as only U.S. citizens are eligible for a security clearance

Nice To Haves

Experience with validation and verification of software applications
Experience/Knowledge of any of the following: Linux/Unix environment
Interfacing with FPGAs
Interfacing with low-level memory drivers
Inter-processor communication
ARM Architecture
Experience designing, implementing, testing, or fielding real-time security-oriented solutions on Department of Defense (DoD) programs (embedded experience highly preferred)
Experience using security-relevant tools and devices for security auditing, network security, host/server security, communication security, or policy management
Experience in Agile and DevSecOps environments
Experience in an Agile/Scrum/Kanban frameworks and development environments
Experience using software configuration management and bug tracking tools
Experience with Python / Perl
Knowledge of modern computer architecture and hardware technologies including: PCIe, GPIO, I2C, SATA
Field Programmable Gate Arrays (FPGAs)
Application-Specific Integrated Circuits (ASICs)

Responsibilities

Act as the Technical Lead and possibly the Agile Product owner for the Software Security Team
Primary owner of the software security implementation to ensure compliance with System Security requirements
Adopt and implement secure coding standards for each programming language used
Drive off-nominal testing by ensuring the software will remain in a secure state during failure conditions and developing negative test cases for bypassing security
Consider using compiler, interpreter and build tool features that improve executable security and ensure the compiler does not optimize out any security-critical behaviors
Provide the software assurance implementation for the Program Protection Implementation Plan (PPIP), including a software vulnerability risk assessment on reused code and the final delivery, and a Software Bill of Materials (SBOM) on the final delivery, partnered with the Systems Security Lead
Applying secure coding principles to the design and development of hardened software applications