Cybersecurity Specialist - Embedded Systems Security & Regulatory Compliance

Requirements Engineering
Elicitation, documentation, and management of security requirements with expert-level traceability between design, requirements, and testing. Translation of complex global regulations (CRA, UN R155/156, ISO 21434, AIS-189, GB44495, IEC 62443) into traceable Security Requirements Specifications (SRS).

Threat Modeling & Risk Assessment (TARA)
STRIDE-based TARA, DREAD, and impact analysis for vehicle/IoT hardware and cloud interfaces. Conducted Threat Analysis and Risk Assessments for vehicle hardware, cloud, and specialized environments including Agriculture ISO 24882 and Energy ISO 27019, resulting in prioritized risk treatment plans.

Embedded Security Architecture
Deep knowledge of Microcontrollers, Secure Boot, HSMs, and Secure Updates (ISO 24089). Definition of security mechanisms for embedded systems including Cryptographic Key Management, ensuring the technical integrity of product architecture.

Cybersecurity Management Systems (CSMS) & Governance
Implementation of Cybersecurity Management Systems and processes to meet ISO/SAE 21434 and UN R155/R156 requirements, providing a structured framework for organizational compliance and successful audits.

Cloud & AI Security
Definition of security requirements and risk profiles for Cloud and AI-driven systems, leveraging frameworks such as ISO/IEC 42001, ISO 27017, NIST CSF, and OWASP to secure vehicle-to-cloud communication.

Incident Response (PSIRP)
Establishment of Product Security Incident Response plans and playbooks, enabling teams to monitor, evaluate, and respond to vulnerabilities within defined timeframes, leveraging standards like ISO/IEC 29147 and ISO/IEC 30111.

Supply Chain & Cybersecurity Interface Agreements (CIA)
Establishment of Cybersecurity Interface Agreements between OEMs and Tier 1 suppliers, resulting in a clear split of responsibilities and alignment on security deliverables across European and Asian supply chains.

Validation & Penetration Testing
Coordination of product-level Penetration Testing activities, definition of test rules, technical prerequisites, and management of resulting security reports.

Process Integration (ASPICE)
Alignment of risk management and analysis with the ASPICE Cybersecurity framework (SEC.1, SEC.2), ensuring that security activities are fully integrated into the engineering lifecycle.

International Project Governance
Management of security deliverables across diverse EU teams in France, Germany, and Romania, ensuring alignment with UNECE and EU CRA frameworks. Leadership of technical kickoff meetings and security workshops for Executive OEM teams and engineering units across Europe.