Product Security Technical Consultant

About the role

We are seeking a Product Security Technical Consultant to guide industrial product development teams on security requirements, regulatory compliance, and AI‑driven secure development practices across large, federated product portfolios. The role can be performed remotely from anywhere in Lithuania, with optional collaboration at our Vilnius or Kaunas offices.

Key responsibilities

• Design and maintain security requirement frameworks, including control libraries, deviation governance, and risk acceptance procedures.
• Translate Cyber Resilience Act (CRA) requirements into engineering specifications covering SBOM governance, secure‑by‑default configurations, and vulnerability handling.
• Conduct OT/ICS security assessments, gap analyses, zone/conduit modeling, and component mapping.
• Lead threat‑modeling workshops using STRIDE, PASTA, or MITRE ATT&CK for industrial control systems.
• Define and implement SDL/SSDLC programs with OWASP ASVS matrices, SAST/DAST/SCA toolchain integration, and secure coding standards.
• Support Notified Body engagements and prepare technical documentation for CRA Class I/II products.
• Design threat models for AI/ML‑enabled industrial products and apply OWASP LLM Top 10 mitigations.
• Integrate AI security controls into DevSecOps pipelines, including model provenance, AI SBOM, and MLOps security gates.
• Perform regulatory gap assessments across CRA, NIS2, EU AI Act, and DORA, delivering remediation roadmaps.
• Present compliance posture and security architecture findings to senior stakeholders and facilitate cross‑functional workshops.

Required profile

• 5+ years of product security advisory experience in industrial environments.
• Deep knowledge of CRA, IEC 62443, and NIS2 frameworks.
• Proven expertise in threat‑modeling methodologies (STRIDE, PASTA, MITRE ATT&CK).
• Strong background in secure SDLC practices and OWASP ASVS compliance.
• Experience with AI/ML security, AI SBOM governance, and EU AI Act conformity for high‑risk AI systems.
• Advanced English (C1) with excellent written and verbal communication skills.

Required skills

• Threat modeling: STRIDE, PASTA, MITRE ATT&CK
• Secure SDLC: OWASP ASVS, SAST, DAST, SCA
• AI security: OWASP LLM Top 10, AI SBOM, MLOps security gates
• Regulatory frameworks: CRA, IEC 62443, NIS2, EU AI Act, DORA
• DevSecOps pipeline integration: CI/CD, CI compliance checks, MLOps

What we offer

• Fully remote work within Lithuania
• Opportunity to shape security practices for large‑scale industrial product portfolios
• Collaboration with senior engineering and security leaders