Embedded Product Security System Engineer

About the role

Collins Aerospace is a leader in technologically advanced, intelligent solutions that help redefine the aerospace and defense industry. With a comprehensive portfolio and deep technical expertise, we help customers meet the demands of the global market. We are seeking a driven System Security Engineer to join our Embedded Product Cybersecurity Engineering team and defend mission-critical platforms from evolving cyber threats. This shared services team supports the development of products throughout the company wherever the customer has security requirements, or the system is exposed to cyber threats by its connectivity or operational use. We develop tools and testing techniques to highlight residual defects in product design or implementation. These defects can lead to vulnerabilities that negatively impact the confidentiality, integrity, or availability of a system. Members of the security engineering team pursue security excellence by embedding with the design and implementation teams as subject matter experts supporting our Secure System Development Life Cycle (SSDLC). This is an on-site position located in Cedar Rapids, Iowa, an established hub for aerospace and systems engineering excellence.

Responsibilities

• Developing threat model / data flow diagrams to ensure data can be properly isolated in motion and at rest
• Implementing mandatory access controls (MAC) through the development of SELinux policies
• Reviewing code to identify weaknesses in the implementation of security functions
• Developing and executing fuzzing and penetration tests to evaluate the robustness of the attack surface
• Conducting vulnerability assessments of proposed and in-service systems
• Authoring and managing cybersecurity certification artifacts to ensure alignment with industry standards and customer requirements

Basic Qualifications

• Bachelor's degree in a STEM field and 2 years of relevant experience OR Advanced degree in Cybersecurity OR In absence of a degree, 6 years of relevant experience is required
• Embedded software development experience in Linux OS environment
• Experience coding in C, C++, Python or Rust
• Networking experience - Layer 2/Layer 3/Layer 4 protocols
• Candidates for this position should be fluent in the software development domain and have a passion for Product Security, and understand the difference between enterprise cybersecurity and securing embedded systems with physical, real-world impacts
• U.S. citizenship is required, as only U.S. citizens are authorized to access information under this program/contract

Preferred Qualifications

• Familiarity with Aviation cybersecurity standards: RTCA DO-326, DO-356, DO-355
• Knowledge of Threat Models and Data Flow Diagrams
• Data/network security implementations with Linux OS
• Understanding tailoring and hardening of Linux OS
• Familiarity with system and application penetration testing
• Experience with SAST and analyzing security impact of code defects
• Executing System & Application Fuzzing / Resiliency Tests
• Knowledge of Public Key Infrastructure (PKI)
• Industry recognized security certifications (Sec+, OSCP, CISSP, etc.) is desirable
• The candidate is required to have excellent communications skills to communicate technical issues and status in both written and oral form
• The candidate must be adaptable to change, determined to accomplish tasks based on program schedule, collaborate with teammates in order to learn and make good decisions, enjoy learning new technologies, and contribute to a positive work environment

Pay & benefits

The salary range for this role is 68,900 USD - 131,100 USD. RTX considers several factors when extending an offer, including but not limited to, the role, function and associated responsibilities, a candidate's work experience, location, education/training, and key skills. Hired applicants may be eligible for benefits, including but not limited to, medical, dental, vision, life insurance, short-term disability, long-term disability, 401(k) match, flexible spending accounts, flexible work schedules, employee assistance program, Employee Scholar Program, parental leave, paid time off, and holidays. Hired applicants may be eligible for annual short-term and/or long-term incentive compensation programs depending on the level of the position and whether or not it is covered by a collective-bargaining agreement. Payments under these annual programs are not guaranteed and are dependent upon a variety of factors including, but not limited to, individual performance, business unit performance, and/or the company's performance.

Schedule & location

This is an on-site position located in Cedar Rapids, Iowa. This position is classified as Onsite: Employees who are working in Onsite roles will work primarily onsite. This includes all production and maintenance employees, as they are essential to the development of our products. For onsite and hybrid roles, commuting to and from the assigned site is the employee's personal responsibility.

This response is AI-generated, for reference only.