What's Happening?
Revel, a company specializing in software for controlling critical hardware across aerospace, automotive, energy, and manufacturing sectors, is actively recruiting its first security engineer. This pivotal role involves establishing Revel's entire security program
from the ground up, without inheriting existing frameworks or legacy decisions. The new engineer will be responsible for securing Revel's product, infrastructure, cloud, on-premises, hardware-integrated environments, and software delivery pipelines. Key responsibilities include threat modeling, security architecture, Infrastructure as Code, detection and incident response, vulnerability management, and ensuring compliance with regulations such as ITAR, NIST, CUI, and CMMC. Revel's software is used to run test campaigns and control hardware for advanced systems like rockets and satellites, often operating in sensitive, export-controlled, and air-gapped environments. The company emphasizes that this is not solely a compliance role, with a significant focus on building and integrating security directly into the product architecture.
Why It's Important?
This hiring initiative underscores the increasing importance of robust cybersecurity in industries dealing with critical hardware and sensitive data. As Revel's software directly controls physical systems in aerospace, automotive, and energy sectors, any security vulnerability could have severe real-world consequences, including operational failures, data breaches, or compromise of national security assets. By investing in a foundational security program from its inception, Revel aims to build trust with its high-stakes clientele, who rely on the integrity and reliability of their systems. The role's emphasis on compliance with ITAR, NIST, CUI, and CMMC highlights the stringent regulatory environment these sectors operate within, particularly for defense and government contractors. Establishing a strong security posture will be crucial for Revel's growth and its ability to handle sensitive projects, ensuring that its technology remains secure against evolving cyber threats and meets the rigorous demands of its customers.
What's Next?
The successful candidate will immediately begin defining Revel's security strategy, architecture, and roadmap, prioritizing critical security initiatives. This will involve integrating security into every stage of product design and development, from threat modeling control software to hardening cloud accounts, Kubernetes clusters, and CI/CD pipelines. The new security engineer will also be responsible for building detection and response capabilities, establishing logging, monitoring, and alerting systems, and leading incident response. Furthermore, they will serve as Revel's primary security contact for defense and aerospace customers, handling security questionnaires and architecture reviews. As Revel expands, this individual will have the opportunity to build and lead a dedicated security team, shaping the future of the company's security function and ensuring its continued adherence to stringent industry standards and customer expectations.
Beyond the Headlines
The creation of this role reflects a broader industry trend where cybersecurity is no longer an afterthought but a core component of product development, especially for companies operating in critical infrastructure and defense. The need for a 'first security engineer' to build a program from scratch indicates a proactive approach to security by Revel, recognizing that retrofitting security measures is often less effective and more costly. This move also highlights the growing demand for security professionals with a deep understanding of both software and hardware interactions, as well as regulatory compliance in highly sensitive environments. The emphasis on securing software that commands physical systems brings to light the convergence of cyber and physical security, where vulnerabilities in code can directly impact real-world operations. This proactive security stance could set a precedent for other companies in similar sectors, emphasizing the ethical and operational imperative of embedding security from the ground up.
