Sr. Principal/ Principal Product Security Engineer
Northrop Grumman28 days ago
Dulles, VA, USAStaff+
Base Salary
$125k - $235k/yr
Responsibilities
- Collaborate with engineering, systems, program, and cybersecurity stakeholders to improve product-security, development, testing, governance, and authorization processes.
- Serve as a hands-on security partner to embedded software, DevOps, ground software, and supporting software teams throughout the software development lifecycle.
- Conduct architecture reviews, code reviews, vulnerability assessments, attack-surface analyses, threat modeling, and security testing for embedded and mission software.
- Integrate and improve SAST, software composition analysis, secret scanning, SBOM generation, infrastructure/configuration scanning, and custom security checks in GitLab CI, Jenkins, or equivalent platforms.
- Develop security tools, automations, integrations, threat models, data-flow diagrams, trust-boundary analyses, misuse cases, and risk assessments using Python, Go, or similar languages.
- Triage security findings, prioritize remediation, and collaborate with engineering teams to resolve risks and manage third-party and open-source software security.
- Develop RMF artifacts such as SSPs, RARs, SCTMs, POA&Ms, control implementation narratives, and security policies and procedures.
- Support PIT system authorization and work with system owners, ISSMs, ISSOs, and assessors to obtain an ATO.
- Translate technical risks into actionable guidance and mentor software and security engineers on secure development practices.],
- requirements:[
- active Top Secret/SCI security clearance at application time; a polygraph is preferred.
- 3–5 years of experience with a bachelor’s degree, 3 years with a master’s degree, or 1 year with a PhD for level 3; level 4 requires 8 years with a bachelor’s degree, 6 with a master’s degree, or 4 with a PhD.
- Proficiency in C or C++ and experience reviewing, developing, or securing embedded software.
- Experience using Python, Go, or a similar language for automations, integrations, or custom tooling.
- Experience with RTOS, embedded Linux, or comparable embedded platforms and with security testing for embedded systems or C/C++ applications.
- Knowledge of secure software development lifecycle practices, vulnerability management, threat modeling, software supply-chain security, and security assessments.
- Familiarity with RMF, ATO processes for PIT systems, NIST SP 800-53, NIST SP 800-160, NIST SP 800-218, and vulnerability-management concepts.
- A bachelor’s or master’s degree in computer engineering, computer science, electrical engineering, software engineering, physics, or a similar technical field is preferred.
- Preferred qualifications include CISSP, CISSP-ISSEP, CSSLP, Security+, or comparable certification; Git and Subversion experience; SAST/SCA tooling; containerized build environments; artifact repositories; code signing; provenance; and attestations.
Requirements
- Active Top Secret/SCI security clearance at application time; a polygraph is preferred.
- 3–5 years of experience with a bachelor’s degree, 3 years with a master’s degree, or 1 year with a PhD for level 3; level 4 requires 8 years with a bachelor’s degree, 6 with a master’s degree, or 4 with a PhD.
- Proficiency in C or C++ and experience reviewing, developing, or securing embedded software.
- Experience using Python, Go, or a similar language for automations, integrations, or custom tooling.
- Experience with RTOS, embedded Linux, or comparable embedded platforms and with security testing for embedded systems or C/C++ applications.
- Knowledge of secure software development lifecycle practices, vulnerability management, threat modeling, software supply-chain security, and security assessments.
- Familiarity with RMF, ATO processes for PIT systems, NIST SP 800-53, NIST SP 800-160, NIST SP 800-218, and vulnerability-management concepts.
- A bachelor’s or master’s degree in computer engineering, computer science, electrical engineering, software engineering, physics, or a similar technical field is preferred.
- Preferred qualifications include CISSP, CISSP-ISSEP, CSSLP, Security+, or comparable certification; Git and Subversion experience; SAST/SCA tooling; containerized build environments; artifact repositories; code signing; provenance; and attestations.
Benefits
- Relocation assistance may be available.
- The position is 100% on-site in Dulles, Virginia and requires an active TS/SCI clearance.
- Benefits include health insurance, life and disability insurance, a savings plan, company-paid holidays, and paid time off.
- Employees may be eligible for overtime, shift differential, and discretionary bonuses.
About Northrop Grumman
Northrop Grumman designs and manufactures aircraft, spacecraft, missile defense, C4ISR, and cyber systems for the U.S. government, NASA, and allied nations. The company operates primarily through long-term defense and space contracts, delivering products and services spanning autonomous systems, sensors, software, and sustainment. Founded in 1994 and headquartered in Falls Church, Virginia, it is a public company listed on the NYSE (ticker: NOC).