Cyber Security Architect (d/f/m)

About the role

Aerbus Cybersecurity's Defence and Strategic Programmes team in Spain is looking for an experienced Cyber Security Architect with proven experience in the defence and aerospace domains. The role covers product security governance, security architecture and risk assessment for Air and Ground segments, and is based in the Madrid area. It is a permanent position.

Key responsibilities

• Product security governance across the entire lifecycle, supporting secure architecture definitions for Air and Ground segments
• Manage security requirements at L1, L2 and L3 levels using DOORS, and model security architecture with Cameo
• Define technical security documents (architecture, cryptographic, review items, ad-hoc SRAs) and support Design Organizations and panels with the Authority and customer (e.g. CISSWG, COMSEC)
• Support key management and certificate management processes
• Execute Security Risk Assessments (SRA) with threat and vulnerability evaluation, propose security solutions and evaluate requirements in them
• Manage formal compliance processes (assessment, certification, accreditation) under CC/CEM, ITSEC and other regulations
• Support systems designers and R&D+I projects, monitor cyber vulnerabilities and carry out impact analysis
• Comply with occupational risk prevention, quality and environmental obligations, and follow Airbus SLC internal policies on information security, privacy and confidentiality

Required profile

• Bachelor's or Master's degree in Telecommunications Engineering, Aerospace Engineering or Computer Science
• Minimum of 2-4 years of experience in information security or aircraft systems
• Ability to obtain and maintain National / NATO security clearance
• English at C1 level; knowledge of TRANSEC/COMSEC, CIS accreditation and NATO standards is an asset
• Knowledge of certification standards such as Common Criteria (ISO/IEC 15408), ITSEC or airworthiness regulations (DO-326A/ED-202A)

Required skills

• Hands-on experience with SRA methodologies
• Hardening of network devices and operating systems
• Vulnerability monitoring tools
• Clear technical documentation
• Methodical rigor, analytical thinking and attention to detail in certification processes