Senior Cybersecurity & OTA Engineer at GILLIG in Loveland, CO

Job description

• We are looking for a Senior Engineer in the CTC team who will be responsible for the overall design, development, and integration of our on-vehicle cybersecurity and over-the-air (OTA) update systems for all future vehicles. You will have direct influence on vehicle electrical systems from concept through to manufacturing launch to field support.
• You will be part of the team that develops the industry’s best-in-class zero emission bus. You will focus on item definitions, cybersecurity concepts, threat assessments, cybersecurity goals, component selection, component compliance, cybersecurity lifecycle management and OTA infrastructure. Assignments are broad in scope and highly complex that require outstanding creativity, superior initiative, good judgement, and leadership skills combined with the willingness to do hands-on engineering.
• This is a hands-on, on-site role at our Loveland, CO facility (Colorado Technology Center) or our Livermore, CA Headquarters and reports to the E/E Systems Engineering Manager. The Colorado Technology Center (CTC) was created in early 2024 and is focused on developing the next generation ZEV powertrains and Advanced Engineering projects for the broader GILLIG enterprise.
• Vehicle Cybersecurity & Over-the-Air Updates
• You will apply your skills & experience to provide highly customized, vehicle-based cybersecurity and over-the-air update systems through definition of on-vehicle assets (items), threats, cybersecurity goals, cybersecurity implementations and component selection. Additional consideration for legacy devices and advanced connectivity devices will also play a major factor as the GILLIG Transit Bus is both a heavy-duty industrial and automotive product. Experience with cybersecurity standards (ISO 21434) and functional safety (ISO 26262) is preferred. Experience in on-vehicle networking, OTA updates and penetration testing is a plus.

Responsibilities

• Conduct Threat Analysis and Risk Assessment (TARA) for vehicle E/E systems
• Define cybersecurity goals, requirements, and specifications for on-vehicle assets
• Develop and maintain the vehicle cybersecurity management system (CSMS) and ensure lifecycle compliance
• Design and implement OTA update architecture including secure boot, code signing, version management, rollback mechanisms and update orchestration
• Oversee cybersecurity validation and verification activities including penetration testing and vulnerability assessments
• Collaborate with E/E and software teams to integrate cybersecurity controls into the vehicle network architecture (CAN, Ethernet)
• Support functional safety analysis and ensure cybersecurity measures do not compromise safety
• Collaborate with suppliers to ensure third-party components and subsystems meet cybersecurity requirements and compliance
• Mentor and provide technical direction for junior engineers on cybersecurity and OTA best practices
• Guide company direction for on-vehicle cybersecurity goals
• Analyze and provide feedback to customer and industry requirements and standards

Requirements

• Bachelor of Science (BS) in Engineering, Computer Science, or Cybersecurity.
• Minimum 5 years of experience in cybersecurity engineering, preferably in automotive, commercial, or heavy-duty vehicle systems.
• Threat analysis and risk assessment (TARA), cybersecurity concept development, and cybersecurity lifecycle management
• Vehicle network security for CAN bus and J1939 protocols
• OTA update systems design, deployment, and validation including secure boot, firmware signing, and delta update strategies
• Functional safety standards (ISO 26262) and their interaction with cybersecurity requirements.
• Heavy-duty vehicle E/E architectures and connected vehicle ecosystems.
• Penetration testing tools and methodologies (e.g., Wireshark, CANoe, bus analyzers) for vehicle network security assessment.
• Standard problem-solving methodologies and tools such as: 8-D, Five Whys, & Fishbone diagrams, as well as cybersecurity incident response frameworks.
• SAE vehicle communication standards such as J1939, J1939-76 (security), and automotive Ethernet protocols.
• Industry and regulatory standards such as UN R155, UN R156, NIST Cybersecurity Framework, APTA, etc.

Skills

Required

• Cybersecurity concept development
• Cybersecurity lifecycle management
• Secure boot
• Firmware signing
• Delta update strategies
• Functional safety standards (ISO 26262)
• Heavy-duty vehicle E/E architectures
• Connected vehicle ecosystems

Preferred

• Cybersecurity standards (ISO 21434)
• Functional safety (ISO 26262)
• On-vehicle networking
• OTA updates
• Penetration testing

Benefits

• Leader in environmentally friendly mobility solutions including battery electric, hybrid electric, near-zero CNG and clean diesel transit buses
• Renowned for its inclusive team/family-oriented culture
• Stable, successful, and growing organization – a Bay Area business for over 132 years!
• Flexible schedules (*depending on project needs)
• Excellent compensation including company paid medical premiums, generous retirement plan and other comprehensive benefits
• $75,000 - $180,000/annual salary + premium benefits
• Pay offered may vary depending on multiple individualized factors, including market location, job classification, job-related knowledge, skills, and experience. The total compensation package for this position may also include other elements dependent on the position offered. Details of participation in these benefit plans will be provided if a candidate receives an offer of employment.