Secure Software and Cryptography Engineer

pThis is a non-renewable post for a limited duration of 4 years and open for the specific needs of a National Project. bAccordingly, the external candidate selected for this post will continue to be considered an external candidate for the purposes of any future applications to the Agency. /b /p pbLocation /bbr/ESEC, Redu, Belgium /p h3bDescription /b /h3 pSecure Software and Applied Cryptography Engineer in the System Security Section (TEC-SES), End-to-End Systems Division, Systems Department, Directorate of Technology, Engineering and Quality. /p pThe System Security Section is responsible for end-to-end system security engineering for the Agency’s missions, projects and activities across space, ground and user segments and communication links, at system, subsystem, element and equipment levels. Its responsibilities span the mission lifecycle from the study phase and definition of requirements to design, development, security integration and verification, and security service preparation, across the full stack, from the physical to the application layer. /p pTo fulfil these functions, the System Security Section defines and conducts the associated research and development (RD) activities and studies and implements the necessary security engineering standards. /p pUsing its security laboratory facilities, the System Security Section performs vulnerability assessments across all areas within its remit and proposes detection methods and mitigation and protection measures using security assessment tools and equipment. /p pThis position will support a third-party activity aimed at developing a national security evaluation laboratory capability. /p h3bDuties /b /h3 pYour tasks and responsibilities will include: /p ul lisupporting the Project Manager by providing recommendations, guidance and plans for test and evaluation laboratory capability development and technologies for software security evaluation; /li liregular reporting to the Project Manager on the status of the duties assigned under the project; /li liengaging directly with and advising national customers and ESA experts on options for developing and maturing software security evaluation capability; /li lideriving technical requirements and reviewing, assessing and evaluating project proposals, including the security design, development, implementation, qualification and validation; /li lifostering new security application areas for multidisciplinary activities, placing emphasis on innovative concepts and cutting-edge technologies in the field of software security evaluation; /li lisupporting laboratory activities as required; /li licontinuously following technological and scientific developments relevant to the position, particularly emerging threats, exploits and industry trends; /li licontributing, as requested, to other technical activities beyond the main project in your area of expertise. /li /ul h3bTechnical competencies /b /h3 ul liSecure software engineering and code analysis /li liApplied cryptography and cryptographic engineering /li liCryptographic side-channel and protocol security /li liSoftware vulnerability analysis, testing and fuzzing /li liSecurity evaluation standards and certification /li liSoftware security evaluation methodologies and laboratory capability development /li /ul h3bBehavioural competencies /b /h3 ul liResult Orientation /li liOperational Efficiency /li liFostering Cooperation /li liRelationship Management /li liContinuous Improvement /li liForward Thinking /li /ul pFor more information, please refer to the ESA Core Behavioural Competencies guidebook /p h3bEducation and professional experience /b /h3 pA master’s degree in a relevant field and, in principle, three years of relevant professional experience are required for this post. Alternatively, candidates with a bachelor’s degree and an additional four years of relevant professional experience may be considered. /p h3bAdditional requirements /b /h3 pIn-depth knowledge of the following: /p ul lisource code review and static code analysis; /li lisecure C/C++ programming; /li liroot causes of vulnerabilities (memory safety, undefined behaviour, integer overflow and underflow, null pointer deference, concurrency and race conditions, input validation, error handling, resource exhaustion, use-after-free and format-string issues); /li litiming attacks; /li licompiler transformations and compiler/linker security features; /li lisecure API design; /li lisecure key/secret handling; /li liserialisation and parsing; /li liinter-process communication; /li lientropy sources and estimation, DRBG construction and health tests; /li liapplied cryptography, including post-quantum (PQC); /li lidesign of modules intended for NIST FIPS-140 validation or equivalent security assurance frameworks, such as EUCC; /li listandards such as FIPS 140-3 and FIPS 197, current PQC standards, and code review standards applicable to test and evaluation facilities; /li lifuzzing; /li lisecure proto