Secure By Design Lead Specialist - Programma Gcap

La posizione è aperta all’interno del team di Leonardo.**Job Description:**Leonardo is an international industrial group and one of the world's leading players in Aerospace, Defense, and Security, specialized in multi-domain technological capabilities in the fields of Helicopters, Aircraft, Aerostructures, Electronics, Cyber Security, and Space. With over 60,000 employees worldwide, the company has a strong industrial presence in Italy, the United Kingdom, Poland, and the United States, and operates in 150 countries, including through subsidiaries, joint ventures, and investments. A key player in major global strategic programs, Leonardo is a technological and industrial partner for governments, defense administrations, institutions, and businesses.Leonardo is one of the strategic industrial partners in the GCAP (Global Combat Air Program), alongside the UK’s BAE Systems and Japan’s Mitsubishi Heavy Industries. This program aims to develop and deliver a next-generation air system, defined as a “system of systems.” Used for multi-domain defense operations, the system will feature a “core platform” connected to other peripheral systems, or “adjuncts,” both manned and unmanned.This program, one of the most ambitious and forward-thinking in the aerospace and defense industries, will drive the technological revolution that will define the sector for the next fifty years. It is a challenge aimed at strengthening the technological and industrial sovereignty of the participating countries, as it focuses on identifying and making available enabling technologies that will ensure a generational leap. These technologies will generate positive returns, contributing to the economic and social progress of the entire nation, benefiting future generations.Those working on this program will have the opportunity to access a career growth path in an internationally competitive and technologically advanced environment.Within the Joint Venture constituted for the realization of the GCAP Program, we are looking for a **Secure by Design Lead Specialist for the GCAP Headquarters located in Reading (UK).****JOB PURPOSE:**Secure by Design Lead Specialist is responsible for embedding security principles into the design and delivery of Edgewing systems, applications, and services from the outset. This role leads specific architecture, threat modelling, and assurance activities, defining standards and reference criteria. Furthermore, it ensures that security is considered early in the project lifecycle, reducing risk, preventing vulnerabilities, and supporting the delivery of secure, resilient, and compliant solutions, aligned with organizational standards and the acceptable risk level.**RESPONSIBILITIES:**The resource will be part of the Governance function for the JV and will report directly to the Secure by Design Manager.**TASKS:*** Lead the implementation of Secure by Design principles within projects, programs, and throughout the entire product lifecycle* Provide specialized advice on design security to technology, digital, and business teams* Review and evaluate solution architectures, technical designs, and project proposals* Early identification of security risks in the design phases and propose proportionate controls* Develop and maintain Secure by Design standards, patterns, and guidelines* Support threat modelling activities and secure architecture reviews* Collaborate with development, engineering, cloud, and infrastructure teams* Ensure alignment with security policies, standards, and regulatory requirements* Support assurance, testing, and approval activities for new or modified services* Promote a culture of security and good design practices within the organization* Contribute to the continuous improvement of security architecture and design processes**REQUIREMENTS:**Qualification: Degree or equivalent qualification in cybersecurity, computer science, engineering, or related disciplinesTechnical knowledge and skills:Relevant professional certifications (or working towards), including:* CISSP, CSSLP, or CISM* SABSA, TOGAF, or similar architectural certifications* Cloud security or application security certificationsEssential requirements:* Solid experience in secure system, application, or solution design* In-depth understanding of Secure by Design principles and security architecture* Experience in conducting security design reviews and threat modelling activities* Strong knowledge of common security risks and related mitigation techniques* Ability to evaluate complex technical designs and identify potential security gaps* Excellent communication skills, including the ability to explain security concepts to non-technical stakeholdersPreferential requirements:* Experience in cloud-native, DevSecOps environments or agile delivery contexts* Knowledge of application security testing techniques and secure coding practices* Experience in regulated or high-risk environments* Familiarity with security frameworks and standards (e.G., ISO 27001, NIST)* Experience in supporting large-scale transformation programs or digital initiatives* Understanding of data protection and privacy-by-design principlesLanguage skills: English C1Leonardo is an international industrial group and one of the world’s leading players in Aerospace, Defense, and Security, specialized in multi-domain technological capabilities in the fields of Helicopters, Aircraft, Aerostructures, Electronics, Cyber Security, and Space. With over 60,000 employees worldwide, the company has a strong industrial presence in Italy, the United Kingdom, Poland, and the United States, and operates in 150 countries, including through subsidiaries, joint ventures, and investments. A key player in major global strategic programs, Leonardo is a technological and industrial partner for governments, defense administrations, institutions, and businesses.Leonardo is one of the strategic industrial partners in the GCAP (Global Combat Air Program), alongside the UK’s BAE Systems and Japan’s Mitsubishi Heavy Industries. This program aims to develop and deliver a next-generation air system, defined as a “system of systems.” Used for multi-domain defense operations, the system will feature a “core platform” connected to other peripheral systems, or “adjuncts,” both manned and unmanned.This program, one of the most ambitious and forward-thinking in the aerospace and defense industries, will drive the technological revolution that will define the sector for the next fifty years. It is a challenge aimed at strengthening the technological and industrial sovereignty of the participating countries, as it focuses on identifying and making available enabling technologies that will ensure a generational leap. These technologies will generate positive returns, contributing to the economic and social progress of the entire nation, benefiting future generations.Those working on this program will have the opportunity to access a career growth path in an internationally competitive and technologically advanced environment.**JOB TITLE:**Within the GCAP Joint Venture Security, we are looking for a Secure by Design Lead Specialist for GCAP HQ in Reading (UK).**JOB PURPOSE:**The Secure by Design Lead Specialist is responsible for embedding security principles into the design and delivery of Edgewing systems, applications, and services from the outset. The role leads specific architecture, threat modelling, and assurance activities and sets standards. The role also ensures security is considered early in the lifecycle of change and transformation initiatives, reducing risk, preventing vulnerabilities, and enabling the delivery of secure, resilient, and compliant solutions aligned to organizational standards and risk appetite.**RESPONSIBILITIES:**The role will be part of the Governance function for the JV and will report directly to the Secure by Design Manager.**OBJECTIVES:*** Lead the implementation of Secure by Design principles across projects, programmes, and product lifecycles* Provide expert security design guidance to technology, digital, and business teams* Review and assess solution architectures, designs, and technical proposals* Identify security risks early in the design phase and recommend proportionate controls* Develop and maintain Secure by Design standards, patterns, and guidance* Support threat modelling and secure architecture reviews* Collaborate with development, engineering, cloud, and infrastructure teams* Ensure alignment with security policies, standards, and regulatory requirements* Support assurance, testing, and sign-off activities for new and changed services* Promote security awareness and good design practices across the organization* Contribute to continuous improvement of security architecture and design processes**REQUIREMENTS:**Qualification: Degree or equivalent qualification in cybersecurity, computer science, engineering, or a related disciplineTechnical Knowledge and skills:Relevant professional certification (or working towards), such as:* CISSP, CSSLP, or CISM* SABSA, TOGAF, or similar architecture certifications* Cloud security or application security certificationsEssential requirements:* Strong experience in secure system, application, or solution design* In-depth understanding of Secure by Design and security architecture principles* Experience conducting security design reviews and threat modelling* Strong knowledge of common security risks and mitigation techniques* Ability to assess complex technical designs and identify security gaps* Strong communication skills, including explaining security concepts to non-specialistsDesirable requirements:* Experience with cloud-native, DevSecOps, or agile delivery environments* Knowledge of application security testing and secure coding practices* Experience working in regulated or high-risk environments* Familiarity with security frameworks and standards (e.G. ISO 27001, NIST)* Experience supporting large-scale transformation or digital programmes* Understanding of data protection and privacy-by-design principlesLanguage skills: English C1**Seniority:** Expert**Primary Location:** IT - Roma - Via Montello**Contract Type:** Permanent**Hybrid Working:** Hybrid