Principal Senior Security Engineer

• As a Principal/Senior Security Engineer, you will play a critical role in shaping the cybersecurity foundation of Vay’s vehicle and remote driving ecosystem
• This is a highly cross-functional role that sits at the intersection of automotive security, embedded systems, safety-critical development, and organizational leadership
• You’ll work closely cross-functionally to ensure our products are designed, developed, and validated with security at the core
• Your work will directly influence how we assess risk, define mitigations, validate security requirements, and scale secure engineering practices across the company
• You will lead and evolve the cybersecurity engineering practices that support Vay’s remote driving technology and vehicle platforms. In order to do that, you will:
• Develop, define, and maintain cybersecurity processes aligned with ISO 21434 and other relevant standards and frameworks such as ISO 27001 and UNECE R155/R156
• Perform security risk assessments and maintain the Threat Analysis and Risk Assessment (TARA) work products
• Define cybersecurity requirements and collaborate with cross-functional engineering teams to implement effective mitigations
• Partner with Safety, Systems, Embedded, and Validation teams to ensure secure product development throughout the lifecycle
• Drive security architecture discussions and influence system-level design decisions across multiple domains
• Create and evolve security testing and validation strategies for vehicle and remote driving systems
• Support secure OTA update mechanisms and secure communication architectures
• Represent cybersecurity topics in internal and external technical discussions and reviews
• Help build scalable security processes that support the growth of Vay’s commercial fleet and technology platform
• You are an experienced security engineer working closely with software, firmware, platform, and systems engineering teams to influence secure product design across the development lifecycle

Benefits

• You will be part of a highly committed, experienced, fun and international team from over 25 countries
• You’ll be a part of improving transportation in metropolitan areas around the world - from Europe
• We offer healthy snacks, drinks and coffee in our modern waterfront office in Hamburg
• We have a generous, highly employee-friendly stock option plan and pay above industry standards
• We organize thoughtful & fun team events throughout the year
• We support highly flexible working policies where possible as well as support for your relocation – it doesn’t matter where you currently live
• We contribute to a FitX or UrbanSportsClub membership, plus free and all-day use of our Gravity Gym in the Berlin office
• We contribute to your monthly public transport ticket in Berlin so that it costs you <50% of the regular price- Good understanding of authentication, authorization, cryptography, secure communications and trust models
• Around 8+ years of experience across cybersecurity engineering, product security, application security, platform security or related areas
• Experience securing complex products involving multiple software, infrastructure, networking, hardware or device components
• Comfortable owning ambiguous problems and operating both strategically and hands-on
• For Principal-level scope, significant experience driving security architecture, technical direction and cybersecurity topics across multiple engineering teams or an organization
• Strong knowledge of security architecture, secure software development, threat modelling, vulnerability management and security risk assessment
• Excellent communication and stakeholder management skills across technical and non-technical audiences
• Strong technical depth and the ability to understand unfamiliar systems quickly
• Experience working with security standards, regulatory frameworks or structured cybersecurity engineering processes
• Experience translating security risks into clear technical requirements and practical mitigations
• Familiarity with ISO 21434, UNECE R155/R156, IEC 62443, the Cyber Resilience Act (CRA) or similar standards and regulations
• Knowledge of embedded Linux, secure boot, secure software updates, hardware-backed security or device lifecycle security
• Experience conducting TARA or comparable structured security risk assessments
• Automotive cybersecurity or vehicle systems security experience
• Experience securing embedded systems, firmware, robotics, IoT, industrial technology, aerospace, medical devices, automotive systems or other cyber-physical systems