Product Security Lead

Product Security Lead

Location: Pune, India

Shift Timing: 1:00 PM – 10:00 PM

Company Overview

Battery Energy Storage Systems (BESS) play a central role in ENGIE’s long‑term strategy, driven by decarbonization, decentralization, and digitalization. These systems are essential to global clean‑energy goals, enabling greater flexibility by complementing renewable energy growth, replacing conventional generation (coal exit), stabilizing power grids (ancillary services), and storing surplus energy (arbitrage).

ENGIE is uniquely positioned to capitalize on these opportunities due to its global footprint, strong industrial expertise, and deep energy‑management capabilities. Through the Renewables and Flexible Generation (R&F‑GBU), ENGIE develops end‑to‑end solutions—from development and construction to operations, optimization, and delivery of flexible energy services.

ENGIE is committed to a diverse, inclusive, and equitable workplace. We ensure a professional environment free from discrimination or harassment, and all qualified applicants will receive equal consideration regardless of gender, identity, race, orientation, religion, disability, or veteran status.

About Broadview

As part of our strategic roadmap, ENGIE is deploying its own Energy Management System (EMS) platform—BroadView EMS—at a global scale. Under the leadership of the CTO of R&F GBU North America, BroadView is already live across more than 1 GWh of assets in ERCOT (Texas) and CAISO (California).

In 2026, BroadView enters a major expansion phase, focused on evolving the platform both technologically and commercially, and enabling global deployment with priority regions including Chile, Belgium, and the Netherlands.

Position Overview

As a key member of a cross‑functional team, you will help define and deliver IT & OT cybersecurity, ensuring it aligns with business goals and operational needs. This includes securing IT/OT systems, cloud environments, and network infrastructures, while maintaining strong collaboration with ENGIE’s global cybersecurity community.

What You Bring

• Bachelor’s degree or higher in engineering, management, science, or technology.
• Minimum 7 years of progressive experience in system security across IT and OT environments.
• Hands-on experience with deployment and configuration of Operating Systems, including Linux, Windows and OT systems.
• Hands‑on experience integrating OT systems securely with IT infrastructure.
• Strong knowledge of networking concepts and industrial protocols.
• Ability to collaborate with data and IT architecture teams.
• Self‑driven mindset suited for dynamic environments.
• Experience in renewable energy or BESS systems.
• Agile and continuous‑improvement oriented.
• Knowledge of DepSecOps practices.
• Experience in vulnerability assessments and penetration testing.
• Familiarity with IEC 62443, NERC CIP, UL 2900 standards.

Skills & Expertise

• Proficiency in OWASP Top 10, SANS Top 25, threat modeling, red teaming, and secure code review.
• Understanding of the Purdue Model for energy‑storage communication and cyber security.
• Knowledge of Cyber‑Informed Engineering (CIE).
• Experience with SCADA/EMS systems, routers, switches, and firewalls.
• Expertise in secure architecture, segmentation, DMZ design.
• Risk assessment and mitigation experience.
• Cyber‑secure supply‑chain knowledge.
• Broad security knowledge in cloud, data, and DevSecOps.
• Strong automation‑focused mindset.
• Excellent communication skills.
• Open‑source contributions are a plus.
• Skills valued more than certifications.

Technical & Security Responsibilities

• Design and engineering of software/firmware security controls.
• Implement and/or oversee implementation of security features and practices.
• Understanding of industrial cybersecurity standards.
• Security architecture design including low‑level hardware interactions.
• Security threat assessment, modeling, and incident reporting.
• Work with cryptographic protocols.
• Implement reporting controls and conduct audits.
• Apply Zero‑Trust and Secure‑by‑Design principles.
• Vendor and supply‑chain security oversight.
• Familiarity with IEEE 1547.3‑2023 and UL 2941.
• Embed security across the development lifecycle.

Core Security Activities

• Implement and manage security practices including patch management, review audit logs.
• Collaboration: Work closely with dev, product, and incident response and Cyber security teams.
• Code Review & Testing: Perform SAST, DAST, penetration tests, and vulnerability assessments.
• Application Security: Expertise in web, mobile, API, and cloud security.
• Cloud Security: Secure IaaS, PaaS, serverless, and container environments.
• Communication: Translate complex security concepts to all audiences.
• Threat Modeling: Identify and analyze threats for new features.
• Offensive Security: Conduct simulated attacks.