Principal Product Cybersecurity Assurance Engineer

The Principal Product Cybersecurity Assurance Engineer will lead product cybersecurity delivery across Humanoid’s HMND 01 platform family, covering concept work through post-market deployment for Alpha Wheeled and Alpha Bipedal robotic systems. This role owns the assurance strategy and key security deliverables required for audit readiness and certification support within highly regulated, safety-critical and AI-enabled contexts.

Core Responsibilities

• Lead and develop a cross-functional team of security engineers, maintaining accountability for delivery of product security services within product teams across the HMND 01 development lifecycle.
• Define product security requirements and advise development teams on appropriate implementation standards, techniques, and toolchains for embedded and AI-enabled robotic systems.
• Partner with cross-functional teams to develop security protocols, tools, and processes that anticipate emerging threats across HMND 01, including attack surfaces tied to the KinetIQ AI inference pipeline and the cloud-to-robot communication architecture.
• Own and maintain key security artefacts for audit-ready cybersecurity documentation, including Security Management Plans, Threat Analysis and Risk Assessment (TARA) reports, Risk Assessments, and Remediation Action Plans for both platforms.
• Drive security assurance across the full product lifecycle to ensure HMND 01 designs are robust, compliant, and resilient.
• Contribute to continual improvement of security engineering capability across the organisation.
• Ensure compliance with cybersecurity obligations under the EU Machinery Regulation 2023/1230 where cyber controls intersect with safety-critical functions, and alignment to IEC 62443 (industrial/OT product security), alongside the EU Cyber Resilience Act.
• Provide independent Information Assurance (IA) reviews and risk assessments on complex, high-impact projects, with emphasis on cyber-physical systems where digital compromise could cause physical harm to operators or end users.
• Review and guide security risk assessments, risk mitigation plans, mitigation gap analysis, and security management documentation to support system cybersecurity certification.
• Establish and maintain a Product Security Incident Response (PSIR) process, covering coordinated vulnerability disclosure, patch deployment pipelines, and post-field incident analysis.
• Define and oversee security monitoring requirements for deployed fleets, ensuring field data feeds back into risk files and security artefacts in line with post-market surveillance obligations.
• Support the creation of work package descriptions and cost estimates for product bids, services, and proposals that include product security scope.
• Represent Humanoid’s security posture in customer and partner engagements, including regulatory consultations and interactions with certification bodies.

Required Qualifications

• Proven, hands-on experience applying ISO 27001/27004/27005 and the NIST Risk Management Framework (RMF) to regulated hardware or embedded product programmes.
• Experience owning a security risk management system for highly regulated, safety-critical products, with background from automotive, commercial vehicle, or industrial automation environments.
• Working knowledge of IEC 62443, including the ability to adapt ISO/SAE 21434 lifecycle methodologies to robotic or electromechanical product contexts.
• Solid understanding of engineering development lifecycles and alignment of the product cybersecurity specialism with systems engineering, functional safety, and hardware/software co-development.
• Ability to interpret Penetration Test reports and author Remediation Action Plans that address vulnerabilities in a structured, risk-prioritised manner.
• Clear, structured communication skills to explain complex security risk arguments to both technical engineers and executive stakeholders.

Relevant Technologies and Standards

• KinetIQ VLM/VLA-based AI framework
• KinetIQ AI inference pipeline
• Cloud-to-robot communication architecture
• IEC 62443
• ISO 27001, ISO 27004, ISO 27005
• NIST Risk Management Framework (RMF)
• ISO/SAE 21434
• EU Machinery Regulation 2023/1230
• EU Cyber Resilience Act
• TARA
• STRIDE, PASTA
• CAN bus
• Ethernet backbone
• Wireless interfaces
• UL 4600, UL 3300
• ISO 13482

Benefits

• Comprehensive health coverage for US-based employees, including fully paid medical, dental, and vision insurance, plus virtual care and employee assistance resources.
• 23 days of PTO (accrued), separate sick leave, and paid company holidays.
• 401(k) retirement plan with 4% employer match.
• Competitive equity via stock options with meaningful upside as Humanoid scales.
• Free daily catered lunch, snacks, and drinks in-office.
• Opportunity to collaborate with top-tier engineers, researchers, and product experts in AI and robotics.
• Freedom to influence the product and own key initiatives.

Preferred Experience

• Familiarity with Threat Analysis and Risk Assessment (TARA) or equivalent threat modelling methodologies (STRIDE, PASTA) applied to embedded or OT/IT convergent systems.
• Understanding of secure-by-design principles for AI/ML-enabled systems, including securing inference pipelines, model integrity, and cloud-to-edge communication paths.
• Exposure to CAN bus, Ethernet backbone, or wireless interface security in mobile, vehicular, or robotic systems.
• Experience contributing to or establishing a Product Security Incident Response (PSIRT) process or coordinated vulnerability disclosure programme.
• Knowledge of UL 4600, UL 3300, or ISO 13482, and understanding of how cybersecurity evidence integrates into safety case arguments.
• Prior engagement with certification bodies (TÜV, UL, BSI) or standards development organisations (ISO TC 184, IEC TC 65, SAE, IEEE RAS).