Experis UK
Product Cybersecurity Engineer (TARA)
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Contract Product Cybersecurity Engineer (TARA)
Location: Hybrid on-site in Surrey for workshops/design sessions
Duration: Initial 3 Months with potential to extend to 6 Months
Rate: TBC based on experience, Outside IR35 status determined by the engaging consultancy
Right to work: UK right to work without sponsorship required. No security clearance needed.
The Role
A specialist product cybersecurity consultancy is looking for additional delivery capacity on an in-flight EU Cyber Resilience Act conformity programme for a UK manufacturer of specialist commercial vehicles. Five ISO/SAE 21434 threat analysis and risk assessments (TARAs) are in scope across three product lines, including CAN-based vehicle controllers with 4G telematics and a connected fleet-management product on an embedded Linux platform.
The method, templates, governance framework and client relationship are already established and owned by the consultancy's Product Security Architect. This role is delivery capacity within that method not a review, re-baseline or redesign of the approach.
Deliverables
- TARAs to ISO/SAE 21434 for assigned product lines, from item definition and asset identification through damage scenarios, threat scenarios, attack path analysis, attack feasibility rating and risk determination, to a documented risk treatment decision
- Derived, testable and traceable cybersecurity requirements
- Cybersecurity assumptions/interface requirements for third-party platform components
- Contribution to the cybersecurity case for assigned product lines
- Facilitation of technical workshops with client engineering, with written outputs
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
All work is subject to independent QA before it reaches the client.
Essential Criteria (must Be Evidenced, Not Just Listed)
- Personally authored at least two completed TARAs to ISO/SAE 21434, item definition through to risk treatment decision and residual risk acceptance, on a product that reached production or formal assessment
- Fluent in the assessment structure: damage scenarios, impact rating, threat scenarios, attack paths, attack feasibility, risk determination, treatment
- Applied a named attack feasibility approach and can justify it over alternatives
- Authored or materially contributed to a cybersecurity case
- Embedded/vehicle systems literacy: ECUs, CAN networks, telematics units, software update paths, embedded Linux
- Derived cybersecurity requirements and passed them to a supplier/integrator, including handling unverifiable third-party platform assumptions
- Facilitated technical workshops with engineers who were not the requesting party
- Assurance-grade written English (documentation that has withstood audit/assessment/regulator scrutiny)
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Desirable
- UNECE R155 CSMtGuard, Ansys medini analyze, itemis SECURE, ThreatGet or comparable
- IEC 62443 alongside 21434
- Off-highway, agricultural, construction, municipal or other specialist vehicle sector experience
- Working knowledge of Yocto/emS development, submission or audit exposure
- TARA tooling: Threabedded Linux build systems
- Functional safety experience alongside cybersecurity
- EU Cyber Resilience Act awareness
What This Role Is NOT
- Not security architecture, Zero Trust or design authority
- Not enterprise, cloud, identity or infrastructure security
- Not CISO, virtual CISO or governance/management-system work
- Not embedded OS implementation (Yocto, kernel config, secure boot, hardening sit with the client's integrator) this role specifies and assures, it does not build
If you receive suspicious outreach claiming to be from us, please contact us via the ManpowerGroup website.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location