Sr. Principal/ Principal Product Security Engineer

Northrop Grumman is hiring a Sr. Principal/Principal Product Security Engineer to help embed security into the end-to-end development, testing, and authorization of mission-critical spacecraft and flight software. This is a 100% on-site role in Dulles, VA, supporting secure development and Authorization to Operate (ATO) using NIST-based RMF artifacts and security engineering practices.

As a hands-on product security partner, you will work alongside embedded software, DevOps, and ground/supporting teams to improve assurance evidence, integrate security tooling into CI/CD, and translate security findings into actionable guidance for engineers, program leadership, and nontechnical stakeholders.

Responsibilities

• Collaborate with engineering, program, systems, and cybersecurity stakeholders to review and improve product-security processes across development, test, governance, and authorization activities.
• Advise software development teams on secure coding practices, secure architecture, embedded system security design, software supply-chain security, and CI/CD pipeline security.
• Perform security assessments for embedded and mission software, including architecture reviews, code reviews, vulnerability assessments, attack surface analyses, and security testing.
• Develop and maintain software threat models, data-flow diagrams, trust-boundary analyses, misuse/abuse cases, and risk assessments for embedded software and supporting platforms.
• Integrate, operate, and improve security tooling within GitLab CI, Jenkins, or equivalent CI/CD platforms, including SAST, SCA, secret scanning, SBOM generation, infrastructure/configuration scanning, and custom security checks.
• Contribute to security tool development and automations using Python, Go, or similar languages to increase engineering velocity and security visibility.
• Triage and validate security findings, collaborate with engineering and technical leadership to assess risk, set remediation priorities, and drive findings to closure.
• Support secure management of third-party, open-source, and internally developed software components, including dependency risk assessments, SBOM review, vulnerability management, and supply-chain security activities.
• Develop standard NIST RMF artifacts such as System Security Plans (SSPs), Risk Assessment Reports (RARs), Security Controls Traceability Matrices (SCTMs), Plans of Action & Milestones (POA&Ms), and supporting policies and procedures.
• Support the system authorization process for Platform IT (PIT) systems and work with system owners, ISSMs/ISSOs, and security control assessors to obtain ATO.
• Mentor software and security engineers on secure development practices and help establish scalable product security standards across the organization.

Requirements

• Active Top Secret/SCI security clearance at the time of application (clearance required for start).
• Experience requirements (based on degree level):
  • Level 3: 8+ years with a Bachelor’s; 3 years with a Master’s; or 1 year with a PhD.
  • Level 4: 8+ years with a Bachelor’s; 6 years with a Master’s; or 4 years with a PhD.
• Proficiency in C or C++ and experience reviewing, developing, or securing embedded software.
• Experience with Python, Go, or a similar language to build automations, integrations, or custom tooling.
• Experience with RTOS, embedded Linux, or comparable embedded platforms.
• Experience developing or performing security testing for embedded systems and/or C/C++ applications.
• Knowledge of secure software development lifecycle practices across requirements, architecture, implementation, test, release, and vulnerability management.
• Ability to analyze security vulnerabilities and work directly with software engineers to prioritize and remediate findings.
• Strong problem-solving, troubleshooting, written communication, and technical collaboration skills.
• Familiarity with the system authorization process for achieving an ATO for PIT systems and experience conducting system security assessments.

Technologies

• C, C++, Python, Go
• GitLab CI, Jenkins, CI/CD, Git, Subversion
• SAST, SCA, SBOM
• RTOS, embedded Linux
• CISSP, CISSP-ISSEP, CSSLP, Security+, CWE, CVE, CVSS, GHSA, CISA KEV
• NIST RMF, NIST SP 800-53, NIST SP 800-160, NIST SP 800-218

Benefits

• Relocation assistance may be available
• Depending on the position, eligibility for overtime, shift differential, and a discretionary bonus in addition to base pay
• Annual bonuses to reward individual contributions and share in company results
• Employees in Vice President or Director positions may be eligible for Long Term Incentives
• Health insurance coverage
• Life and disability insurance
• Savings plan
• Company paid holidays
• Paid time off (PTO) for vacation and/or personal business

Travel: Yes, 10% of the Time

Location: Dulles, VA (onsite) | Clearance type: Top Secret | Clearance required for start: Yes

Salary: USD 125,300 - 234,600 per yearly (Primary level range: $125,300.00 - $187,900.00; Secondary level range: $156,400.00 - $234,600.00)

Application period: Estimated 20 days from the job posting date