Consultant – Product Security & Regulatory Compliance (Industrial OT/AI)

About the role

We are looking for a Consultant to strengthen our advisory practice for industrial operational technology (OT) and AI‑embedded product development. You will guide clients through complex regulatory landscapes, embed security into engineering delivery, and translate compliance obligations into actionable technical specifications for federated product portfolios.

Key responsibilities

• Design and maintain product security requirement frameworks, including control libraries, deviation governance, risk acceptance and change‑propagation models.
• Translate Cyber Resilience Act essential requirements into engineering specifications such as SBOM governance, secure‑by‑default configurations, vulnerability handling and CE marking documentation.
• Perform OT/ICS security level assessments, zone/conduit modeling and component requirement mapping with evidence packages for client conformity verification.
• Lead threat‑modeling workshops using STRIDE, PASTA or MITRE ATT&CK for ICS and deliver prioritized risk registers and control recommendations.
• Define and implement SDL/SSDLC programs, including OWASP ASVS matrices, SAST/DAST/SCA toolchain integration and secure coding standards for embedded software.
• Support Notified Body engagements, prepare technical documentation for CRA Class I/II products and author security architecture evidence for regulatory submissions.
• Design threat models for AI/ML‑enabled industrial products, apply OWASP LLM Top 10 mitigations and integrate AI security controls into DevSecOps pipelines.
• Conduct regulatory gap assessments across CRA, NIS2, EU AI Act and DORA and present findings to senior client stakeholders.

Required profile

• Proven experience in product security and regulatory compliance for industrial OT or AI‑embedded systems.
• Strong understanding of European security regulations such as the Cyber Resilience Act, NIS2, EU AI Act and DORA.
• Ability to work remotely from anywhere in Lithuania and collaborate with teams in Vilnius and Kaunas.

Required skills

• Threat‑modeling methodologies: STRIDE, PASTA, MITRE ATT&CK.
• Security development lifecycle (SDL/SSDLC) and OWASP ASVS.
• Static and dynamic analysis tools: SAST, DAST, Software Composition Analysis (SCA).
• SBOM creation and management, including AI SBOM.
• OT/ICS security assessment techniques and zone/conduit modeling.
• MLOps security controls, model provenance and CI/CD security gates.