旧塩港電氣工業製造社 主页旧塩港電氣工業製造社 主页

高级专家，嵌入式软件安全与安全架构

Senior Expert Embedded Software Security & Security Architectures

意法半导体（STMicroelectronics）

地点
勒芒，法国 那不勒斯，意大利
资历
senior
编号
12360

半导体

职责

  • 负责制定和监督 RFOC 子组产品的软件安全策略，领导面向汽车和非汽车应用的安全嵌入式软件架构设计。
  • 建立符合产品和市场需求的安全要求、安全控制和架构原则。
  • 审核并批准与安全相关的设计决策，确保符合内部标准和外部法规。
  • 支持嵌入式系统的威胁分析、风险评估和安全概念活动，全面负责安全开发。
  • 在整个开发生命周期中推动软件安全活动：需求管理、架构和详细设计、实现、集成、验证和测试。
  • 确保安全功能在各个软件组件中得到一致且稳健的实现。
  • 指导工程团队采用安全开发实践，并保持从安全需求到验证证据的可追溯性。
  • 在嵌入式软件团队中推广和执行安全编码实践。
  • 执行或领导安全代码审查、漏洞评估和修复计划。
  • 定义安全开发指南、编码规则和防御性编程实践。
  • 参与软件漏洞和安全弱点的分析和缓解工作。
  • 与软件工程团队紧密合作，推动安全相关活动的执行和质量。
  • 为参与安全需求、设计、实现、集成和测试的工程师提供技术指导和培训。
  • 与项目管理、质量保证、产品管理、系统工程和其他利益相关者协作，帮助团队做出切实可行的、基于风险的决策。
  • 适应不断变化的优先级、计划和技限制，在工作量高峰期保持绩效。
  • 支持安全相关风险和执行障碍的问题解决和升级管理。
  • 关注嵌入式安全、汽车网络安全和安全开发方法论的最新趋势。
  • 推动开发工作流程的创新，包括利用人工智能驱动的工具和方法提高生产力、质量和效率。
  • 为工具、方法、模板和最佳实践的持续改进做出贡献。

必备要求

  • 在嵌入式软件设计和开发方面拥有丰富的经验。
  • 在嵌入式产品的软件安全、安全架构或网络安全工程方面拥有丰富的经验。
  • 具有在汽车开发环境中工作并应用基于 ASPICE 的流程的经验。
  • 具备 ISO/SAE 21434、汽车网络安全工程实践、通用准则和 SESIP 的实践知识。
  • 具备安全编码、代码审查和安全漏洞缓解方面的经验。
  • 具备支持技术审计、质量审查和面向客户的安全评估的经验。
  • 深入理解嵌入式软件架构、实时性限制和系统集成。
  • 扎实的软件安全概念知识，包括：身份验证和授权、密码学基础和安全密钥处理、固件完整性保护、安全更新机制、攻击面减少、安全通信原则。
  • 了解安全功能的测试和验证方法。
  • 熟悉安全分析技术，例如威胁建模和风险评估。
  • 具备较强的多学科团队协作能力。
  • 能够在不一定拥有直接管理权限的情况下，影响和指导工程团队。
  • 优秀的沟通能力，能够清晰地向技术和非技术受众解释复杂的安全主题。
  • 在动态项目环境中具有高度适应性和韧性。
  • 具有强烈的责任感、主人翁意识和积极主动性。
  • 思想开放，具有创新精神，并能熟练运用现代工具和人工智能辅助方法。

Responsibilities

  • Define and oversee the software security strategy for RFOC subgroup products, leading secure embedded software architecture design for automotive and non-automotive applications.
  • Establish security requirements, security controls, and architectural principles aligned with product and market needs.
  • Review and approve security-related design decisions, ensuring compliance with internal standards and external regulations.
  • Support threat analysis, risk assessment, and security concept activities for embedded systems, taking full responsibility for secure development.
  • Drive software security activities throughout the development lifecycle: requirements management, architecture and detailed design, implementation, integration, verification, and testing.
  • Ensure consistent and robust implementation of security functions across software components.
  • Coach engineering teams in secure development practices and maintain traceability from security requirements to verification evidence.
  • Promote and enforce secure coding practices within embedded software teams.
  • Perform or lead security code reviews, vulnerability assessments, and remediation plans.
  • Define secure development guidelines, coding rules, and defensive programming practices.
  • Participate in the analysis and mitigation of software vulnerabilities and security weaknesses.
  • Collaborate closely with software engineering teams to drive execution and quality of security-related activities.
  • Provide technical guidance and training to engineers involved in security requirements, design, implementation, integration, and testing.
  • Collaborate with project management, quality assurance, product management, systems engineering, and other stakeholders, helping teams make pragmatic, risk-based decisions when ideal solutions are constrained by technical, time, cost, or project realities.
  • Adapt to changing priorities, evolving plans, and shifting technical constraints, maintaining performance during peak workloads.
  • Support problem-solving and escalation management for security-related risks and execution obstacles.
  • Stay current with the latest trends in embedded security, automotive cybersecurity, and secure development methodologies.
  • Actively drive innovation in development workflows, including leveraging AI-driven tools and methods to improve productivity, quality, and efficiency.
  • Contribute to continuous improvement of tools, methods, templates, and best practices.

Must Have

  • Strong experience in embedded software design and development.
  • Strong experience in software security, security architecture, or cybersecurity engineering for embedded products.
  • Experience working in automotive development environments and applying ASPICE-based processes.
  • Practical knowledge of ISO/SAE 21434, automotive cybersecurity engineering practices, Common Criteria, and SESIP.
  • Experience with secure coding, code reviews, and security vulnerability mitigation.
  • Experience supporting technical audits, quality reviews, and customer-facing security assessments.
  • Deep understanding of embedded software architecture, real-time constraints, and system integration.
  • Solid knowledge of software security concepts, including: authentication and authorization, cryptography fundamentals and secure key handling, firmware integrity protection, secure update mechanisms, attack surface reduction, secure communication principles.
  • Knowledge of testing and verification methods for security functions.
  • Familiarity with security analysis techniques such as threat modeling and risk assessment.
  • Strong multidisciplinary teamwork skills.
  • Ability to influence and guide engineering teams without necessarily having direct management authority.
  • Excellent communication skills, able to clearly explain complex security topics to technical and non-technical audiences.
  • Highly adaptable and resilient in dynamic project environments.
  • Strong sense of responsibility, ownership, and proactiveness.
  • Open-minded, innovative, and proficient in modern tools and AI-assisted methods.

公司简介

意法半导体（ST）是一家全球半导体公司，先进的技术和芯片构成了当今世界的隐形基石。公司员工来自超过115个国籍，业务遍及40个国家，拥有超过50,000名多元化且敬业的技术创造者和制造者。ST致力于协作与尊重，鼓励充满热情、渴望打破现状、推动创新并释放潜能的人才加入，共同打造更智能、更环保、更可持续的未来。ST荣膺2025年全球最佳雇主认证的17家公司之一，也是首家获此殊荣的半导体公司，在道德与诚信、目标与价值观、组织与变革、业务战略和绩效等方面表现突出。公司致力于营造多元包容的工作环境，绝不容忍任何形式的歧视，力求在职业发展、职业机会和薪酬方面实现公平。