HVDC NPI - Product Security Leader

Overview

The HVDC Product Security Leader (PSL) leads the Secure Development Lifecycle (SDL) process on all NPI/Product care scope and coordinates with Development and Validation Teams along with domain experts and CTHs associated. This role tracks and validates SDL artifacts from specifications to test, delivery and monitoring, and manages product/system vulnerabilities and incidents in coordination with concerned teams. The PSL reports to the HVDC NPI Leader and functionally to the Global GSI Cybersecurity Leader.

• Execute the Secure Development Lifecycle (SDL) and Incident and Vulnerability Management compliance according to GE policies. This includes requirements definition, threat modeling, static code analysis results analysis, high level design validation and test strategy specifications, security assessments, penetration testing, secure deployment guides, and security bulletins publication.
• Coordinate with R&D software teams to ensure all relevant SDL artifacts are ready and verified for the NPI technical reviews and tracking.
• Contribute to decisions related to technology choices and design to align with the cybersecurity strategy and roadmap.
• Contribute to cybersecurity testing tools specifications, testing, and evaluation of new security technology and products.
• Implement the cybersecurity vulnerability and incident process, including vulnerability assessment, solution definition (in collaboration with the development team), communication with external parties where applicable, and drafting security advisories.
• Share best practices and lessons learned; continuously update the technical cybersecurity architecture in collaboration with other product security leads, domain architects and experts.
• Develop and conduct relevant security training for internal audiences, such as product managers, software engineers and technical support.

• Bachelor’s Degree in Engineering, Computer Science, or Information Technology from an accredited university.
• Experience with secure software development (SDL) and security best practices in software development.
• Extensive experience in secure software design, secure coding, and security testing (including static code analysis), preferably in an Operational Technology (OT) environment.
• Demonstrated knowledge of network communications protocols in the TCP/IP stack.
• Awareness of latest technical developments in the cybersecurity community.
• Demonstrated experience with Linux, VxWorks and Windows operating systems including user account management, security/system hardening, device control, and patch management.
• Experience with Telecom and Network Equipment (Routers, Switches, Firewalls).
• Experience with secure testing tools, fuzzing, and vulnerability assessment reviews.
• Experience with security technologies such as cryptography, PKI infrastructure, LDAP, RADIUS, SSH, SFTP, HTTPS, SYSLOG, TLS, RSA and code signing.
• Knowledge of cybersecurity standards and regulations affecting the utilities industry (e.g., IEC 62443, NERC CIP, IEEE 1686, IEC 62351).
• Excellent oral and written communication skills; ability to work effectively in a team and across functions in a worldwide environment.

• Experience with penetration testing.
• Knowledge of industrial communication protocols (Modbus, DNP3/IEC-104, IEC 61850).
• Cybersecurity certifications (e.g., ISC2, SANS, ISACA, CISSP).
• Experience with programming and scripting languages.
• Strong customer service mindset and interpersonal/leadership skills.

EEO Statement: GE is an equal opportunity employer and supports diversity.