Principal Product Security Architect

Overview

In this role you will translate evolving product security regulations into actionable engineering requirements. You will work across product security, engineering and legal teams to integrate regulatory obligations into Arm’s SDL and development practices. You will assess regulatory risks, guide policy creation, and support incident response and regulatory reporting. You will represent Arm in standards groups and help drive cross‑functional alignment on compliance. This is a chance to shape secure, regulation‑ready products at scale.

Pay / Benefits

• relocation package
• visa sponsorship support
• hybrid working
• inclusive recruitment experience

Responsibilities

• Translate cybersecurity regulations into clear product and engineering requirements
• Lead regulatory risk assessments and gap analyses with action plans
• Develop and implement policies, frameworks, and processes for regulatory alignment
• Embed regulatory requirements and Secure-by-Design practices into Arm’s SDL
• Partner with engineering and product teams to integrate compliance throughout development
• Support incident response planning and regulatory reporting obligations
• Drive alignment of regulatory, contractual and certification requirements across teams
• Develop guidance, training and mentorship for CRA and other regulations
• Represent Arm in industry, regulatory and standardisation activities

Key requirements

• Strong understanding of EU CRA, ENISA, UK PSTI, BSI, NIS2, and OpenSSF communities
• Experience with Security Development Lifecycles and product security assurance (requirements management, threat modelling, security testing, incident response)
• Ability to interpret legal/regulatory text and translate into actionable technical requirements
• Experience collaborating across multidisciplinary engineering teams and communicating complex topics
• Regulatory advocacy, industry working groups or standards development experience

• Clear communication
• Cross-functional collaboration
• Ability to translate regulatory concepts for varied audiences
• Threat modelling
• Requirements management
• Security testing

…