Cybersecurity Expert

About the team: Join the Orange Innovation Polska team building together with a partner a system for quantum key exchange QKD DI. The project ends with a pilot deployment at a client's site. Your area will be the security methodology for the classical part of the system: KME, interfaces, management network, and integration of the quantum layer with IT/telco infrastructure. Job description: You will co-create the security methodology for the classical part of the QKD system: KME component, API interfaces (ETSI GS QKD 014), authenticated channels, management network, and integration with the client's infrastructure. Documentation will be built in a structure similar to Security Target (Common Criteria / ISO/IEC 23837). Cooperation with the security expert for the quantum part, the KME development team, and CyberSec and Network units. Cybersecurity Expert Your scope of duties: Development of a security assessment methodology for the classical part of the system (KME, API, management network) Threat modeling (including using MITRE ATT&CK) and risk analysis Definition of security requirements (SFR) and TOE boundaries for Security Target type documentation Planning and supervision of security tests for the prototype and pilot environment Assessment of compliance with ISO/IEC 23837, ETSI GS QKD 014, and industry best practices Security support for the pilot deployment at the client's site Technical stack: Methodology: Agile Code and knowledge repository: GitLab Code review: GitLab Static code analysis: Sonar Version control system: Git CI/CD: GitLab Our requirements: Over 5 years of experience in systems and network security, covering architecture, evaluation, and security testing Ability to model threats and analyze risks for systems with high security requirements Conducting or supervising security tests, such as vulnerability configuration tests and penetration tests Knowledge of classical cryptography, including AES TLS PKI and cryptographic key lifecycle Familiarity with Common Criteria standards (ISO/IEC 15408), including TOE, SFR, and Security Target concepts, as well as ISO/IEC 27001, FIPS 140-3, and NIST 800-88 standards for data sanitization Experience with HSM (Hardware Security Module) Fluent knowledge of English and Polish Nice to have: Knowledge of ISO/IEC 23837 and ETSI GS QKD 014 and 016 standards, and BB84 and E91 protocols CISSP certification Using threat modeling based on the MITRE ATT&CK framework Experience in cloud security on the Google Cloud Platform Understanding of automation and scripting in Python Practice in security certification processes Experience in securing operator networks in the telecommunications industry or critical systems What we offer: Stable employment based on an employment contract Hybrid or predominantly remote work Participation in a unique project in the field of quantum technologies Training budget Cooperation with scientific and international partners Pension program – after 6 months of work, Orange will contribute 7% of your gross salary to your pension account each month Private medical care at PZU Zdrowie Interest-free loans for housing, health, and other purposes Subsidies for recreation FitProfit sports card Integration events and trips co-financed from the social fund Opportunity to join group insurance on preferential terms Smartphone with unlimited Internet – also for private use Preferential offer for Orange services Diverse and tailored development opportunities – training, access to educational platforms (including language learning platforms), internal internship programs, and inspiring educational events "Health Yes" - program for people with disabilities "I'm in the game" – support for parents returning to work after parental leave Wellbeing programs Volunteering in cooperation with the Orange Foundation