Principal, Cybersecurity Engineering

Schneider Electric’s purpose is to empower all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be your digital partner for Sustainability and Efficiency. We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloud connecting products, controls, software and services, across the entire lifecycle, enabling integrated company management, for homes, buildings, data centers, infrastructure and industries. We are the most local of global companies. We are advocates of open standards and partnership ecosystems that are passionate about our shared Meaningful Purpose, Inclusive and Empowered values.

Job purpose

Schneider Electric is searching for a Cyber Security Advisor / Architect for its Energy Management Business CTO Cybersecurity Centre of Excellence team. The role combines cybersecurity architecture, technical advisory, Secure Development Lifecycle governance, and system-level cybersecurity assurance across legacy and modern products and solutions. The Security Advisor / Architect will partner with offer development, system and software architecture, verification and validation, regulations, conformity, technical leaders, and the corporate Product Security Office (PSO) to ensure cybersecurity requirements, guidelines, and processes are applied effectively and consistently. The successful candidate will combine strategic and process leadership with strong technical depth and hands-on engagement. The role requires an ownership mindset, the ability to influence decisions, and the confidence to escalate material cybersecurity risks. Establishing and improving representative system-level cybersecurity verification environments, including a system lab, is an additional responsibility that enables effective security assessment; it is not the primary purpose of the role.

Responsibilities

• Cybersecurity Architecture and Advisory: Provide security architecture guidance to offer and development teams across embedded, software, network, cloud, mobile, and industrial system environments. Review end-to-end architectures, interfaces, data flows, trust boundaries, attack surfaces, third-party integrations, and security controls.

• Cybersecurity Integration in Development: Act as the cybersecurity subject-matter expert for offer development and ensure security-by-design principles are embedded from concept and architecture through implementation, verification, release, and maintenance. Support vulnerability triage, root-cause analysis, remediation planning, and validation.

• Secure Development Lifecycle Enablement: Guide and coach teams in applying Secure Development Lifecycle practices, including security requirements, threat modelling, secure design, secure coding, security testing, vulnerability management, and security evidence management. Promote shift-left practices in both legacy and agile/DevSecOps environments.

• Threat and Risk Assessment: Lead or review threat models, attack-path analysis, risk assessments, and security-design decisions. Ensure that cybersecurity controls and verification activities are proportionate to product criticality, deployment context, threat exposure, and business risk.

• System-Level Cybersecurity Assurance: Define and review risk-based cybersecurity verification strategies for integrated products and systems. Ensure security requirements and threat scenarios are translated into measurable acceptance criteria, test plans, and traceable evidence.

• Security Verification Oversight: Support and review functional security testing, negative and misuse-case testing, vulnerability assessment, robustness testing, fuzzing, penetration testing, and remediation verification. Analyse results and provide clear recommendations for risk treatment and security acceptance.

• System Lab and Verification Environment Enablement: Contribute to the definition, setup, and continuous improvement of representative system-level cybersecurity verification environments and testbeds. Work with engineering and verification teams to identify required equipment, system configurations, network topologies, tools, access controls, operating practices, and automation. The responsibility is to enable architecture and assurance outcomes rather than serve as the primary lab operations owner.

• Standards and Regulatory Alignment: Support deployment of cybersecurity processes and technical controls aligned with applicable standards and regulations, including IEC 62443 and other relevant product or system cybersecurity frameworks. Translate requirements into practical architecture, development, and verification expectations.

• Formal Reviews and Audit Support: Support internal Secure Development Lifecycle audits and Formal Cybersecurity Reviews (FCSRs). Evaluate the completeness and quality of security artefacts and evidence, track gaps, and drive issues to appropriate closure or documented risk acceptance.

• Privacy by Design: Perform or support foundational data protection and privacy screening of offers so that privacy requirements are considered from the initial design stages.

• Cross-Functional Collaboration: Work closely with Line of Business developers, architects, validation teams, product owners, regulations and conformity teams, and PSO stakeholders. Represent offer-development perspectives in security meetings and workshops, and keep R&D leadership informed of material risks, emerging requirements, and recommended actions.

• Training and Capability Building: Develop and deliver targeted training, coaching, and technical guidance to strengthen cybersecurity architecture, SDL execution, threat modelling, and verification competencies within engineering teams.

• Maturity and Continuous Improvement: Monitor relevant cybersecurity and SDL maturity objectives, identify recurring gaps, and lead pragmatic improvements in methods, templates, tooling, verification coverage, and evidence quality.

• Cybersecurity Community Engagement: Contribute actively to the Energy Management and company-wide cybersecurity communities, sharing reusable practices and lessons learned.

Key skills and requirements

• 13+ years of relevant experience in cybersecurity, security architecture, product security, software or system engineering, Secure Development Lifecycle, or related engineering disciplines.

• Strong experience providing cybersecurity architecture or advisory support to product and engineering teams.

• Ability to review end-to-end system architectures and assess security across software, firmware, hardware interfaces, networks, cloud services, identities, data flows, and third-party components.

• Strong understanding of software and system development methodologies, including Agile, DevOps, CI/CD, and engineering lifecycle controls.

• Demonstrated experience with threat modelling, attack-surface analysis, cybersecurity risk assessment, and risk-treatment recommendations.

• Working knowledge of security verification methodologies and tools, including SAST, DAST, dependency scanning, container security, vulnerability assessment, fuzzing, penetration testing, protocol analysis, and remediation verification.

• Ability to convert cybersecurity requirements and threat scenarios into architecture decisions, verification criteria, test expectations, and traceable evidence.

• Experience identifying, analysing, prioritising, and driving remediation of cybersecurity vulnerabilities across integrated system components.

• Knowledge of industrial or connected-product architectures, networking concepts, authentication and authorisation, secure communications, certificates, logging, hardening, update mechanisms, and resilience.

• Ability to align corporate cybersecurity, data security, and privacy policies with product and business requirements.

• Process discipline and attention to detail, with the ability to translate security requirements into practical controls in partnership with architects and engineering teams.

• Strong communication and influencing skills, including the ability to explain complex technical risks to technical and non-technical stakeholders and to escalate when appropriate.

• Self-starter and team player with the ability to work independently, manage ambiguity, and drive cross-functional initiatives to closure.

• Good level of English is mandatory.

Qualifications and preferred expertise

• Experience working in Engineering or R&D organisations that follow a Secure Development Lifecycle based on IEC 62443, ISO 21434, Microsoft SDL, or comparable practices.

• Experience developing or reviewing security architectures for embedded, cloud, mobile, industrial automation, operational technology, or energy-management solutions.

• Experience with cloud environments such as AWS, Azure, or GCP and with hybrid edge-to-cloud architectures.

• Knowledge of secure coding standards and weakness taxonomies such as OWASP and CWE.

• Experience with industrial communication protocols, network traffic analysis, packet inspection, and security testing of connected products.

• Experience supporting or establishing system integration labs, cybersecurity testbeds, verification environments, or cyber ranges. This is an additional selection criterion rather than the central identity of the role.

• Experience with test automation, reusable security test harnesses, environment configuration, and evidence capture.

• Experience supporting certification, conformity, customer assurance, internal audit, or formal product-security reviews.

• Recognised cybersecurity certification such as CISSP, CSSLP, IEC 62443 Cybersecurity Expert/Specialist, or an equivalent security architecture or product-security credential.

• Project management or technical leadership experience, with demonstrated influence, negotiation, and stakeholder-management skills.

• Strong analytical, problem-solving, reporting, and presentation skills.

Success indicators

• Engineering teams receive timely, practical, and risk-based cybersecurity architecture guidance.

• Threats, requirements, architecture decisions, verification activities, findings, and evidence remain traceable through the development lifecycle.

• Material cybersecurity risks are identified early, communicated clearly, and driven to remediation, mitigation, or documented acceptance.

• System-level security verification is representative of intended architectures and deployment scenarios.

• The system verification lab and associated test environments mature in line with priority assurance needs without displacing the role’s core advisory and architecture responsibilities.

• Formal cybersecurity reviews and audits are supported by complete, credible, and reusable technical evidence.

What's in it for me?

• Recognition as a technical expert with meaningful impact on organizational security

• Opportunity to lead significant projects and influence security strategy

• Supportive team culture that values innovation and specialized expertise

• Professional growth through specialized training and certifications

Bring your cybersecurity expertise to a team that's ready to support your success — apply today!

Rewards designed for you

Our Total Rewards is our way of saying: We see you and we value you. It’s more than just pay and benefits—it’s a meaningful investment in you. It is designed to help you perform, grow, feel safe, and elevate your potential. The package helps you care for yourself and your family, plan your future, grow your skills and career, collaborate in an inclusive workplace, and contribute to your community. At Schneider Electric, we’re here for what matters most to you. Discover more at our Career Page.

• Country-specific programs and initiatives may be available.

Looking to make an IMPACT with your career?

When you are thinking about joining a new team, culture matters. At Schneider Electric, our values and behaviors are the foundation for creating a great culture to support business success. We believe that our IMPACT values – Inclusion, Mastery, Purpose, Action, Curiosity, Teamwork – starts with us. IMPACT is also your invitation to join Schneider Electric where you can contribute to turning sustainability ambition into actions, no matter what role you play. It is a call to connect your career with the ambition of achieving a more resilient, efficient, and sustainable world. We are looking for IMPACT Makers; exceptional people who turn sustainability ambitions into actions at the intersection of automation, electrification, and digitization. We celebrate IMPACT Makers and believe everyone has the potential to be one. Become an IMPACT Maker with Schneider Electric – apply today!

• €40 billion global revenue

• +9% organic growth

• 150 000+ employees in 100+ countries

You must submit an online application to be considered for any position with us. This position will be posted until filled. Schneider Electric aspires to be the most inclusive and caring company in the world, by providing equitable opportunities to everyone, everywhere, and ensuring all employees feel uniquely valued and safe to contribute their best. We mirror the diversity of the communities in which we operate, and ‘inclusion’ is one of our core values. We believe our differences make us stronger as a company and as individuals and we are committed to championing inclusivity in everything we do. At Schneider Electric, we uphold the highest standards of ethics and compliance, and we believe that trust is a foundational value. Our Trust Charter is our Code of Conduct and demonstrates our commitment to ethics, safety, sustainability, quality and cybersecurity, underpinning every aspect of our business and our willingness to behave and respond respectfully and in good faith to all our stakeholders. You can find out more about our Trust Charter here Schneider Electric is an Equal Opportunity Employer. It is our policy to provide equal employment and advancement opportunities in the areas of recruiting, hiring, training, transferring, and promoting all qualified individuals regardless of race, religion, color, gender, disability, national origin, ancestry, age, military status, sexual orientation, marital status, or any other legally protected characteristic or conduct.