Sr. Principal/ Principal Product Security Engineer

Embed security throughout the mission lifecycle while supporting spacecraft and flight software that require authorization to operate. Northrop Grumman is seeking a Sr. Principal/Principal Product Security Engineer (TS/SCI) to partner with engineering, systems, and cybersecurity teams, develop RMF deliverables, integrate security tooling into CI/CD, and support the ATO process. This 100% onsite role is based in Dulles, VA.

Compensation: USD 125,300 - 234,600 per year (with level-based salary ranges). Travel: Yes, 10% of the time.

Responsibilities

• Collaborate with engineering, program, systems, and cybersecurity stakeholders to review and strengthen product-security processes across development, testing, governance, and authorization activities.
• Act as a hands-on product security partner to embedded software, DevOps, and ground or supporting software teams throughout the software development lifecycle.
• Advise software teams on secure coding practices, secure architecture, embedded system security design, software supply-chain security, and CI/CD pipeline security.
• Perform security assessments of embedded and mission software, including architecture reviews, code reviews, vulnerability assessments, attack surface analyses, and security testing.
• Develop and maintain threat models and security analyses for embedded software and supporting platforms, including data-flow diagrams, trust-boundary analyses, misuse or abuse cases, and risk assessments.
• Integrate, operate, and improve security tooling within GitLab CI, Jenkins, or equivalent CI/CD platforms, including SAST, SCA, secret scanning, SBOM generation, infrastructure and configuration scanning, and custom security checks.
• Contribute to security tool development and automation using Python, Go, or similar languages to improve engineering velocity and visibility while supporting assurance evidence collection.
• Triage and validate security findings, then collaborate with engineering and technical leadership to evaluate risk, set remediation priorities, and drive findings to closure.
• Support secure management of third-party, open-source, and internally developed components through dependency risk assessments, SBOM review, vulnerability management, and related supply-chain security activities.
• Develop standard RMF artifacts including System Security Plans (SSPs), Risk Assessment Reports (RARs), Security Controls Traceability Matrices (SCTMs), Plans of Action and Milestones (POA&Ms), and supporting control implementation narratives and security policies.
• Support system authorization for Platform IT (PIT) systems and work with system owners, ISSMs/ISSOs, and security control assessors to obtain an Authorization to Operate (ATO).
• Translate security risks and technical findings into clear, actionable guidance for engineers, program leadership, and nontechnical stakeholders.
• Mentor software and security engineers on secure development practices and help establish scalable product security standards across the organization.

Requirements

• Active Top Secret/SCI security clearance at the time of application.
• Education and experience: lvl 3 requires 8+ years experience depending on degree level (Bachelor’s 3 years, Master’s 3 years with 3 years additional experience as specified, or PhD with 1 year as specified per level). lvl 4 requires at least 8 years experience depending on degree level (with Bachelor’s, Master’s, or PhD equivalents as specified).
• Proficiency in C or C++ and experience reviewing, developing, or securing embedded software.
• Experience with Python, Go, or a similar language to build automations, integrations, or custom tooling.
• Experience with RTOS, embedded Linux, or comparable embedded system platforms.
• Experience developing or performing security testing for embedded systems and/or C/C++ applications.
• Knowledge of secure software development lifecycle practices, including requirements, architecture, implementation, test, release, and vulnerability management.
• Experience analyzing security vulnerabilities and partnering with software engineers to prioritize and remediate findings.
• Strong problem-solving, troubleshooting, written communication, and technical collaboration skills.
• Familiarity with system authorization for achieving an ATO for PIT systems and experience conducting system security assessments.

Technologies

• C, C++, Python, Go
• GitLab CI, Jenkins, CI/CD, Git, Subversion
• SAST, SCA, SBOM
• RTOS, embedded Linux
• CISSP, CISSP-ISSEP, CSSLP
• Security+, CWE, CVE, CVSS, GHSA, CISA KEV
• NIST RMF, NIST SP 800-53, NIST SP 800-160, NIST SP 800-218

Benefits

• Relocation assistance may be available.
• Depending on the position, eligibility for overtime, shift differential, and a discretionary bonus in addition to base pay.
• Annual bonuses designed to reward individual contributions and share in company results.
• Long Term Incentives may be available for employees in Vice President or Director positions.
• Health insurance coverage.
• Life and disability insurance.
• Savings plan.
• Company paid holidays.
• Paid time off (PTO) for vacation and/or personal business.

Clearance required to start: Yes (Top Secret). Role setup: 100% onsite in Dulles, Virginia. Application period: estimated 20 days from the job posting date.