Principal Product Security Architect

Job Overview We’re looking for a Product Security Regulatory Compliance Engineer to join our Product Security team, helping Arm translate emerging cybersecurity regulations and standards into actionable, scalable engineering solutions.

With a particular focus on the EU Cyber Resilience Act (CRA), alongside other global regulatory obligations, the role will help integrate regulatory requirements across Arm’s products, engineering practices and Secure Development Lifecycle (SDL).Working across Engineering, Product Management, Security, Legal and Compliance, the role will help Arm meet evolving product security requirements while supporting innovation and trust. It will also represent Arm in international standards and regulatory working groups, contributing to the development of industry approaches to product security!

Responsibilities This role will help shape Arm’s response to the evolving product security regulatory landscape, providing subject matter expertise and helping teams apply new requirements in practice.

The role includes monitoring, evaluating and interpreting emerging product security regulations, including the EU Cyber Resilience Act (CRA), NIS2 and U.S. cybersecurity labelling requirements, while providing subject matter expertise on security-related regulatory obligations.

Working across Product Security, Engineering, Architecture, Legal, Compliance, Quality and Functional Safety, the role will:

Translate cybersecurity regulations and standards into clear product and engineering requirements.

Lead regulatory risk assessments and gap analyses, identifying actions needed to meet evolving product security obligations.

Develop and implement policies, frameworks and processes that support product alignment with security regulations.

Embed regulatory requirements and Secure-by-Design practices into Arm’s Secure Development Lifecycle (SDL).Partner with engineering and product teams to integrate compliance requirements throughout product development.

Support incident response planning and regulatory reporting obligations.

Drive alignment of regulatory, contractual and certification requirements across relevant teams.

Develop guidance, training and mentorship to support the practical application of the CRA and other product security regulations.

Represent Arm in relevant industry, regulatory and standardisation activities.

What we're looking forWhat will help you succeed in this role?

This role requires a strong understanding of product security regulations, standards and their associated communities, including the EU CRA, ENISA, UK PSTI, BSI, NIS2 and OpenSSF.We’re looking for experience with Security Development Life cycles and product security assurance, including requirements management, threat modelling, security testing and incident response. The ability to interpret legal and regulatory text and translate it into actionable technical and engineering requirements is also important.

The role involves collaborating across multidisciplinary engineering teams and communicating complex regulatory and security topics clearly to different audiences. We also value experience in regulatory advocacy, industry working groups or standards development.

Nice to have

We’d welcome experience in one or more of the following areas:

Security of embedded systems, semiconductors or software supply chains.

Low-level software or hardware development and architecture.

Security standards and assurance schemes including ISO 21434, IEC 62443, SESIP and PSA Certified.

Semiconductor technologies, including SoCs, processor IP or Compute Subsystems.

Cybersecurity standardisation or regulatory engagement.

Additional Information Please note that a relocation package (including visa sponsorship support) is available for this…