Product Security Engineer (Secure Software)

Job Description
At Boeing, we innovate and collaborate to make the world a better place. We're committed to fostering an environment for every teammate that's welcoming, respectful and inclusive, with great opportunity for professional growth. Find your future with us.
Location:
Brisbane
Category:
Engineering / Technical
Position Type:
Permanent
Job Reference:
BOE/1954757
Attachments:
No File Attached
Share This:
About Us
Do you aspire to help build something better? Would you like to work for a company that employs the best talent to develop and deliver world class capabilities and systems to protect Australia and its national interests? Would you like to work on cutting edge projects? Then we would like to talk to you.
As an equal opportunity employer that promotes a diverse and safe workplace environment, one of the country's leading and preferred defence partners, Boeing Defence Australia (BDA) is now recruiting a System Security Technical Lead in Brisbane to support the MQ-28 Program.
The Opportunity
We are seeking a senior product security engineer to lead the implementation and embedding of secure software development practices on the MQ-28 program. You will lead the development of architecture patterns that engineering teams will use. You will also lead the development and implementation of LLM security in a development toolchains and in mission autonomy applications.
The successful candidate will have comprehensive awareness and practical experience applying product security engineering design practices, experience embedded secure software development practices, and experience with AI or ML in safety-related or autonomous systems contexts. This is a technical leadership role with no direct reports. You lead through the patterns you publish, the reviews you run and the engineers you coach and support.
The role is based at Boeing's head office at 123 Albert St, Brisbane CBD.
What you will do
Lead the embedding of secure software development

• Develop the secure software development processes and capabilities for the Program's software teams: threat modelling at design, secure coding standards, dependency and supply-chain controls, SAST, DAST and SBOM in the pipeline, code signing and security acceptance at release.
• Support and coach DevSecOps resources through the implementation of secure software development activities into DevSecOps pipelines.
• Coach software and DevSecOps engineers in threat modelling and secure design practices.
• Produce the evidence that system accreditation needs (ISM, DSPF) as a by-product of the pipeline, not as a separate exercise.

Design security architectures and patterns

• Write and maintain the reference security patterns engineering teams: identity and access for services, secrets handling, cross-domain and classified data flows, logging for investigation, secure update and configuration.
• Review system and software architectures at design review.
• Translate ISM, Essential Eight (E8) and DSPF controls into engineering patterns, so the control is met by the design.

Advise on security of LLMs

• For development: set the rules for LLM coding assistants and agents in the toolchain in accordance with frameworks such as the ISM and NIST.
• For autonomy: provide advice to MQ-28 systems and missionization teams on security of AI and ML components in the platform and its ground system. Threat modelling for model inputs and outputs, integrity of models and training data, adversarial input and model supply chain.
• Build the test approach for AI components: prompt injection and tool-abuse testing for agents, robustness and integrity testing for autonomy models, and the evidence an IRAP assessor will accept.
• Be the program's reference on the latest AI security guidance (ASD, NIST, allied partners).

About You
To be successful in this role, you will have:

• A Tertiary degree qualification in an engineering or related technical discipline.
• Demonstrated experience in applying relevant engineering practices, standards and regulations throughout the development lifecycle.
• Hands-on with a modern pipeline: you have incorporated SAST, dependency scanning and SBOM generation into CI and tuned them for performance.
• Security architecture experience across identity, secrets, logging and data flows, in a regulated environment (e.g. Defence, aerospace, critical infrastructure or finance).
• Working knowledge of LLM security: prompt injection, tool-use risk, agent permission models, model and data supply chain. You have deployed or secured at least one LLM-backed tool in a real environment.
• Ability to translate ISM controls into engineering requirements.
• Superb communication skills and the ability to collaborate, educate and influence within a multi-discipline team.
• Australian citizenship to meet Defence security requirements.

Desirable

• Experience with AI or ML in safety-related or autonomous systems: model integrity, adversarial robustness, assurance arguments.
• Familiarity with DSPF, DISP, ISM and/or NIST and the accreditation process for classified systems.
• Experience in C, C++, Rust or Ada toolchains and embedded or real-time software.
• A security certification relevant to the role (CompTIA+, CISSP, CISM, SSCP, software security, or equivalent).
• Defence industry and/or government security experience.
• NV1 clearance (or higher).

What's on offer?
Boeing values the health and wellbeing of our employees and offer true flexibility including working from home, compressed work weeks, and opportunities for part time arrangements, allowing you to balance your career with what is important to you outside of work.
Other benefits:

• Work on cutting edge projects with opportunities to work across platforms.
• Attractive remuneration and annual bonus.
• Formal mentoring and training as well as on the job learning.
• Formal reward and recognition program.
• Access discounts for health insurance, travel and accommodation.
• Paid study leave, paid parental leave and Defence leave.
• Salary packaging options available.
• Health and wellbeing benefits including annual flu vaccinations and Employee Assistance Program.
• Social and community groups.

BDA works with strong links with our global Boeing community and we strongly encourage collaboration with our international counterparts.
We are committed to building a diverse and inclusive workplace. Female applicants, people of Aboriginal or Torres Strait Island descent and veterans are encouraged to apply.
Equal Opportunity Employer:
We are an equal opportunity employer. We do not accept unlawful discrimination in our recruitment or employment practices on any grounds including but not limited to; race, color, ethnicity, religion, national origin, gender, sexual orientation, gender identity, age, physical or mental disability, genetic factors, military and veteran status, or other characteristics covered by applicable law.
We have teams in more than 65 countries, and each person plays a role in helping us become one of the world's most innovative, diverse and inclusive companies. We are proud members of the Valuable 500 and welcome applications from candidates with disabilities. Applicants are encouraged to share with our recruitment team any accommodations required during the recruitment process. Accommodations may include but are not limited to: conducting interviews in accessible locations that accommodate mobility needs, encouraging candidates to bring and use any existing assistive technology such as screen readers and offering flexible interview formats such as virtual or phone interviews.