Global Product Cyber Security Expert – R&D Digital Portfolio EM&AO

Your role and responsibilities

Working as a Global Digital Portfolio Cyber Security Expert, you will play a critical role in safeguarding our organization's digital assets for products of the global AUEN Digital Energy Management / Autonomous Operations products.

You will be responsible for defining, governing and assuring cybersecurity-by-design across global R&D product development, ensuring compliance with ABB Product Security requirements, international standards (e.g. IEC 62443), and applicable regulations.

The role acts as global cybersecurity reference for the Digital Energy Management and Autonomous Operations product portfolio, working with R&D teams to embed security requirements into architectures, software, and lifecycle processes (SPDLC), while challenging designs and approving security readiness.

In this role, you will be part of a global team of product owners, software developers, architects, and testers to apply principles of software engineering, contribute to development as part of different state-of-the-art cloud and edge software systems and architectures of the product portfolio.

You will be hosted in one of the team locations: Mannheim (DE), Genoa (IT), Bangalore (IN) in a hybrid mode (#LI-Hybrid)

Relocation of the candidate is not required.*

Your work will have a profound impact on the global cloud, cloud-native and edge platform landscape.

You will be mainly accountable for:

Cyber Security Management:

Develop and implement comprehensive cyber security strategies, policies, and procedures to protect digital on-prem/edge/cloud products against cyber threats, including malware, phishing, data breaches, and insider threats following the minimum cyber-security requirements from ABB in full compliance, and responsibility, with PSA (Product Security Assessment) internal process.

Conduct regular security assessments and audits to identify vulnerabilities, risks and take proactive measures to address them.

Respond promptly to security incidents.

Implement access controls, encryption, and other security measures to safeguard sensitive data in line with Global Digital Team direction.

Compliance and Risk Management:

Stay up to date with industry Standards & Compliance, regulations, and best practices related to cyber security and cloud computing, such as GDPR, NIS2, ISO/IEC 27001 and IEC 62443 SL3.

Conduct risk assessments and develop mitigation strategies to ensure compliance with regulatory requirements and industry standards.

Collaborate with internal teams and external auditors to ensure adherence to compliance requirements and address any findings, incidents or recommendations by executing and coordinating: investigation, schedule, corrective actions and disaster recovery plan to ensure business continuity.

Other responsibilities/skills:

• Collaborate with all organization members to contribute to the overall software development lifecycle in assigned areas and reach targets, share knowledge and contribute to a positive work atmosphere
• Follow agile software development practices to build and deliver software in an iterative and incremental manner as part of a global team’s scrum-based development process
• Continue your personal learning journey by staying abreast of new and evolving software engineering technologies and sharing knowledge with team members
• A high level of self-motivation, curiosity, as well as a strong desire and ability to learn and adapt to new technologies, tools, and programming languages
• Strong analytical and problem-solving skills with the ability to troubleshoot and debug software issues
• Project management capabilities
• Scrum and Agile methodologies knowledge
• Ensure that CI/CD pipelines and DevSecOps practices incorporate cybersecurity controls and security testing requirements.

Qualifications for the role

• Master's degree in computer science with a focus on IT security. A PhD with cyber security focus is considered a plus.

  Advanced degrees or certifications (e.g., CISSP, CISM, CCSP) preferred.

  10 years of proven experience in product or system cybersecurity for industrial or critical systems.

  5 years in cloud computing, with a strong understanding of security principles, technologies, and best practices.

  Hands-on experience with cloud platforms such as AWS, Azure, or Google Cloud, including proficiency in cloud services and management tools. Familiarity with Azure DevOps for CI/CD pipelines.

  Strong experience with Kubernetes, Docker, and Podman for container orchestration and management.

  Proficiency in OAuth 2.0, OpenID Connect (OIDC), and identity management solutions such as Keycloak.

  Experience with Helm charts for managing Kubernetes applications and deployments.

  Strong understanding of the design and architecture of microservices, including principles such as loose coupling, bounded contexts, and domain-driven design.

  Excellent communication and collaboration skills, with the ability to effectively communicate technical concepts to non-technical stakeholders and work cross-functionally with internal teams geographically distributed.

  Ability to work independently and prioritize tasks in a fast-paced environment, while also collaborating effectively as part of a global team.

  Effective verbal and written communication skills in English, eventually German if location is Germany. Willing to travel, time to time, for office/site visit.