NTNU PhD in Maritime AI Cybersecurity: Security and Trustworthiness

NTNU PhD in Maritime AI Cybersecurity: Security and Trustworthiness

Research question and project fit

How can maritime organisations assess the security and trustworthiness of AI when its data, models and operational setting all introduce different risks? This doctorate connects technical assurance with human and organisational decisions. A useful contribution must distinguish measured system security from perceived risk, and an available research dataset from permission to use or publish it.

This three-year employed doctorate examines how maritime AI can remain secure and trustworthy across its data, models and operational use. Its distinctive advantage is the combination of the Ålesund maritime ecosystem, CPS Lab and the Norwegian Maritime AI Centre (MAI). The strongest disciplinary connections are cybersecurity, AI, maritime engineering, risk/safety management and human factors, with a relevant master's qualification required. The research question and method are deliberately open to development with the candidate, use cases and industrial partners.

Two conditions should be clarified before investing in the full proposal: eligibility for CONFIDENTIAL or higher security clearance, obtainable within a reasonable period after employment, and the advertisement's external-funding condition. Neither the centre's grant nor the university's inclusive recruitment statement resolves these conditions for an individual. There is no evidence supporting either universal eligibility or a blanket exclusion of Chinese nationals. Ask the named contacts for an individual eligibility/process clarification without sending sensitive personal information in an initial enquiry. The advertised deadline is 19 November 2026. Official advertisement.

Research Problem and Doctoral Work

What Is Unsolved and Why It Matters

The advertised problem is broader than applying a classifier to vessel data. An AI system can inherit risks from training data, the model itself, or its integration into operational workflows. The position names data poisoning/manipulation risks, privacy and confidentiality, secure sharing, and methods for evaluating security and trustworthiness. These are candidate research topics rather than an obligation to cover every threat category. Information security, AI, maritime operations and data engineering are the advertised disciplinary combination.

The centre's use-case portfolio illustrates why deployment context matters: surveillance combines multiple data sources, remote operations depend on understandable status information, and predictive maintenance needs dependable equipment assessments. Those examples help frame potential use cases; they do not establish which dataset, ship, industrial partner or operational system will be available to this doctoral researcher. MAI use cases.

The professional problem is credible. IMO connects cyber risk management to shipping safety management, and the saved page lists MSC-FAL.1/Circ.3/Rev.4 guidance. DNV's 2024/25 maritime survey landing page reports persistent OT, supply-chain and skills concerns despite increasing awareness and investment. Regulation and an industry survey indicate relevance, not guaranteed employment outcomes or a measured shortage of doctoral graduates. IMO, DNV.

Work, Methods, and Potential Outputs

The confirmed duties are to complete doctoral education, perform high-quality research, publish and communicate results to academic and public audiences, join CPS Lab and MAI activities, undertake industry dissemination, and participate in international conferences and/or research stays. Duties can change after appointment. The advert does not prescribe a programming language, a benchmark dataset, an attack implementation, an experimental vessel, a number of papers or a fixed methodology.

Three defensible proposal directions follow from the evidence, but remain analyst suggestions:

Possible direction	Research question and evaluation focus	Access or scope dependency
Trustworthy data sharing	How can maritime partners assess data provenance, confidentiality and responsibilities while retaining useful AI evidence? Compare governance requirements and defensible assessment criteria across authorised cases.	Partner agreements, permitted data and confidentiality review.
AI assurance in a bounded use case	Which security/robustness indicators are meaningful for a particular maintenance, monitoring or navigation-support task? Compare a clearly defined baseline with a proposed defensive assessment method.	Agreed system boundary, representative data, suitable baseline and permission to publish.
Human and organisational cyber risk	How do operators and data owners understand risks introduced by AI and shared data? Relate interview/survey evidence to operational decisions and assurance needs.	Participant access, ethics approval and a design that distinguishes perception from measured system security.

Potential research outputs could include a bounded risk-assessment framework, validated defensive evaluation method or empirical study, with reproducible non-sensitive evidence where permitted. These are possibilities, not promised deliverables. The first feasibility discussion should establish what can be researched and published under security and commercial restrictions. Current MAI master's topics in cyber risk perception for AI data sharing and protection of maritime AI models show adjacent activity, without fixing this PhD's scope. Current student projects.

School, Programme and Field Context

NTNU is the employing university and intended doctoral institution; the host is the Department of ICT and Natural Sciences in Ålesund. Its current department page describes practically oriented engineering/computing teaching. Industry links are particularly relevant here because research needs realistic maritime decisions and data. The job names admission to the PhD programme in Engineering within three months of the employment-contract start, followed by participation in organised doctoral education throughout employment. The general Engineering programme lists three years full-time, research and coursework, and campuses including Ålesund. The responsible programme council/faculty arrangements and individual training plan should be confirmed, especially since the employing department and Marie's staff affiliation are in different departments. Department, Engineering PhD.

For institutional context, QS reports NTNU 267th overall in 2026 and 264th overall in 2027. ShanghaiRanking explicitly reports the 2026 ARWU overall band 151–200. The saved institutional profile's 2026 GRAS statement lists Marine/Ocean Engineering 8, Computer Science & Engineering 76–100 and Artificial Intelligence 76–100. These are broad subject rankings, not Ålesund cybersecurity laboratory results. These institutional indicators support a research-university context, not a cybersecurity ranking for Ålesund or evidence of individual supervision quality. The more directly relevant field signal is the confirmed maritime AI, autonomous-systems and industry network. QS history, ShanghaiRanking.

The advertised three-year contract is not converted into four years by general programme examples of teaching-duty contracts. MAI's 2026–2030 centre period and approximately 25 doctoral scholarships describe a wider network; they do not lengthen this appointment. Oslo, AHO, the naval academy, mapping authority, MET and SINTEF partners have research-network roles, with no confirmed joint or double degree for this vacancy.

Supervisor and Lab Assessment

Research Directions and Confirmed Roles

Marie Haugli-Sandvik is the strongest confirmed subject contact: her official profile identifies maritime cybersecurity, human behaviour, operational risk and risk perception, alongside maritime education and onboard experience. MAI lists her as WP3 co-lead and among its PhD/postdoc supervisors. Current MSc supervision demonstrates an extension towards AI data-sharing risk and AI-model protection. This evidence supports a plausible intellectual connection; the vacancy itself still does not appoint her as the principal supervisor. Profile, Centre roles.

Rune Volden is head of the employing department and a named job contact. His recent public publication list includes prediction evaluation and research software in health informatics. It should not be treated as a maritime-cybersecurity publication record or proof that he will supervise this doctorate. Rune Volden.

CPS Lab head Erlend Magnus Lervik Coates works on autonomous ships, motion control and energy management; he is relevant to the advertised lab environment, not a confirmed supervisor of this post. Confirm main/co-supervisors, division of technical and human-factors expertise, meeting arrangements and security/publication support. Coates.

Recent Original Research: Contributions and Reading Limits

The saved official Marie Haugli-Sandvik profile lists the 2022 same-title/same-DOI paper under Larsen, Marie Haugli, directly establishing the institutional authorship link; no legal name-change date or reason is inferred.

The following are three distinct original studies from 2022–2025, not three publications by an already appointed supervisor. The first two are directly connected to the advertised contact; the third is maritime research from the confirmed host lab. The 2021 systematic review is not counted towards the three-paper analysis.

Cyber risk perception: qualitative model, 2022

Larsen, Marie Haugli; Lund, Mass Soldal; Bjørneseth, Frøy Birte (2022). “A model of factors influencing deck officers’ cyber risk perception in offshore operations.” Maritime Transport Research 3, 100065. DOI: 10.1016/j.martra.2022.100065. The publisher-indexed abstract describes in-depth interviews and constant comparative analysis, producing a contextual model around perceived distance from cyber risk, digital restrictions and trust in systems/suppliers. It provides a qualitative precedent for asking how operational actors interpret new AI risks. It does not establish that these factors cause incidents or generalise unchanged to AI-data partnerships. Reading: publisher-indexed abstract/highlights only; direct access failed, full methods and sampling not verified. Publisher record.

Perceived IT and OT risk: survey, 2024

Haugli-Sandvik, Marie; Lund, Mass Soldal; Bjørneseth, Frøy Birte (2024). “Maritime decision-makers and cyber security: deck officers’ perception of cyber risks towards IT and OT systems.” International Journal of Information Security 23, 1721–1739. DOI: 10.1007/s10207-023-00810-y. Survey data from 293 offshore deck officers were analysed using Wilcoxon comparison and hierarchical regression. Perceived OT risk was lower than IT risk; trust was not a significant predictor in the reported models. For proposal design, distinguish risk perception from objective vulnerability and specify the population/system boundary. This was a nonrandom survey, not causal proof of training effectiveness or evidence about all AI users. Reading: abstract plus selected methods, results and discussion; individual linked tables and all supplementary material not exhaustively read. Article.

Host-lab modelling and validation context, 2025

Kandemir, Ege; Coates, Erlend Magnus Lervik; Hasan, Agus (2025). “SINDy-based modeling of an uncrewed surface vessel with experimental validation.” Applied Ocean Research 165, 104825. DOI: 10.1016/j.apor.2025.104825. The abstract describes a three-degree-of-freedom, field-data-based USV digital twin and comparisons of polynomial versus physics-informed function libraries; it reports 26.8% lower average RMSE for the custom library. This illustrates interpretable modelling and an explicit validation comparison in the host lab. It is not a cybersecurity experiment, a method promised for this PhD, or proof of robust security under malicious conditions. Reading: publisher-indexed abstract/highlights only; full experimental setup, baselines and uncertainty not verified because direct access failed. Publisher record.

Before relying on numerical results or transplanting methods, obtain and read the complete papers. Two contact-linked studies and one host-lab study are a bounded starting bibliography, not evidence of three recent AI-security studies by the eventual supervisor.

Resources and Collaboration Environment

CPS Lab explicitly advertises this vacancy and lists maritime AI, robotics/autonomous systems and energy informatics. Its public page identifies maritime projects, Seaonics work on machine vision/remote load handling and a drone lab opened in 2026. This supports an active applied environment, but does not promise access to those assets for a classified or commercially restricted project. MAI reports approximately 40 overall partners, whereas the advertisement describes about 30 user partners plus research partners and cluster members; these count different categories. CPS Lab, MAI.

Bibliographic date limits: the 2022 paper is confirmed to year 2022/volume 3, with exact first-online day and numbered issue unknown. The 2024 paper was published online 2 February 2024 and assigned to the June 2024 issue; a numbered issue was not independently verified. The 2025 paper has December 2025 issue metadata; exact first-online day and numbered issue remain unknown. Dates do not upgrade the stated scientific reading levels.

Funding, Application, and Living Cost

Employment and Funding Boundaries

The vacancy states code 1017, normally NOK 580,000 gross per year, depending on qualifications and seniority, with a 2% statutory pension contribution deducted, for three years. It provides project working capital, career guidance, mentoring, employee benefits, SPK terms and basic A2 Norwegian training. It requires daily physical presence and availability. The position remains conditional on external funding.

The Research Council award-results table identifies NTNU's MAI project 359242 and NOK 100 million centre-level funding. This is useful corroboration of the network, but it does not certify that this individual employment contract is unconditional. Ask whether funding has been secured for this position and whether an offer has outstanding conditions. Do not infer a personal share of the centre grant. Award results.

Budget Evidence and International Arrangements

NTNU's undated Ålesund student guidance lists shared-room rent NOK 4,500–6,500/month plus utilities, food at least NOK 3,600/month, and transport at least NOK 500/month. HK-dir's national guidance gives a 2026/27 student living-cost reference of NOK 15,488/month or NOK 170,368/year. These are differently scoped planning references, not a private-market rental quote or an employee budget. National annual guidance must not be treated as twelve identical months of costs. Ålesund guidance, National guidance.

The salary is employment income, rather than a tax-free scholarship. Personal tax, housing eligibility, deposits, relocation, family costs and the start-year cost environment remain unresolved; no net salary or future savings is calculated. National guidance says doctoral candidates are normally exempt from tuition at public institutions. General student semester-fee or study-permit statements should not automatically be imposed on an employed PhD: obtain NTNU's employee-specific fee and immigration instructions.

Eligibility and Submission

The controlling job requirements are:

• A relevant master's or equivalent in cybersecurity, AI, information security, maritime studies, marine technology, risk/safety management, human factors, engineering or another relevant discipline; education equivalent to a five-year Norwegian course, including 120 master's-level credits.
• Master's/equivalent academic performance comparable to NTNU B or better, or an equally good foundation where grades are not letter-based. A weaker grade background may be considered with documented particular suitability; this is discretionary, not an automatic waiver.
• Admission eligibility for the faculty's doctoral programme; Engineering PhD admission within three months after contract start and organised doctoral participation throughout employment.
• Written and spoken English fluency. Holders of MSc degrees from institutions outside Europe are expected to document proficiency. Only extraordinary circumstances allow formal evidence to be relinquished, with interview assessment instead; no automatic medium-of-instruction waiver or invented test score is asserted.
• Eligibility for, and reasonable-period acquisition of, CONFIDENTIAL or higher clearance, plus assessment under export-control rules. Conflicting export-control circumstances prevent employment. NSM confirms the clearance level distinction; its separate foreign-citizen authorisation guidance is largely about the lower BEGRENSET level and cannot decide this vacancy's eligibility. NSM clearance, Authorisation guidance.

Maritime-industry knowledge, AI knowledge or interest, and B2-equivalent Norwegian/Scandinavian communication are preferred, not universal mandatory prerequisites. The advert also values independent/team work, structured planning, flexibility, research discussion, analysis and interpersonal qualities.

Submit electronically through the official recruitment system by 19 November 2026. The saved official job text gives the date but no clock; another collected deadline record gives 23:59 Europe/Oslo, which must be checked in the submission system. Prepare:

1. Bachelor's and master's transcripts/diplomas, CV and master's thesis; a recently submitted thesis draft is allowed, but completed master's documentation is required before appointment.
2. A project outline, maximum 1,500 words / four pages, covering questions, theoretical perspectives, methodological design and progress plan.
3. A short motivation letter, 400 words / one page.
4. Relevant publications/research and certificates where applicable; names and contacts of three relevant referees.
5. For overseas education, documentation of the scope/quality of the whole education, including bachelor's, master's and other higher education; a diploma supplement where issued, and an HK-dir statement if already held. The latter is not presented as mandatory advance recognition for every candidate.

Explain personal contributions where joint work makes them difficult to identify. Documents may be Norwegian, another Scandinavian language or English. Only information received by the deadline is assessed; certified documents may be requested at interview. Selection considers qualifications, motivation, ambition and potential, with DORA/CoARA commitments to broad contributions. After the deadline a public applicant list includes name, age, job title and municipality; exemption requests require justification and refusal is notified.

Academic/job contacts: Marie Haugli-Sandvik, marie.h.sandvik@ntnu.no; Rune Volden, rune.volden@ntnu.no. Recruitment: Silje Kjersem, silje.s.kjersem@ntnu.no.

Applicant Fit and Preparation

The research setting connects backgrounds that can explain both a maritime operational problem and a defensible security/AI evaluation. A machine-learning portfolio without security reasoning, or operational knowledge without a plan to acquire research methods, leaves important gaps. This is a comparison of preparation needs, not a personalised admission prediction.

Keep evidence separate: required degree/grades/English/clearance conditions come from the advert; maritime knowledge, AI interest and Scandinavian B2 are preferences; reproducible analysis, statistics, ethical interviewing and risk-framework familiarity are suggested preparation. No particular software language, commercial certificate or specific attack experience is advertised as compulsory.

A useful outline would choose one bounded case, define its stakeholders/data permissions, distinguish the research question from a tool-building task, state a defensible comparator and evaluation criteria, identify ethics/security dependencies, and plan a fallback if industry data cannot be released. A technical candidate could illustrate evaluation discipline; a human-factors candidate could show careful study design and the limits of perception measures. Neither route should promise operational attacks or unrestricted release of sensitive data.

Career relevance

Career relevance includes maritime risk assurance, trustworthy AI/data governance, safety-linked security assessment and research roles. IMO guidance, DNV's stated skills concerns and the local centre support this connection. They do not establish visa access, security clearance, a salary premium or a guaranteed position after graduation.

Next Actions and Questions to Verify

Before Applying

• Ask whether the employer can assess the individual's clearance feasibility and explain the authorised screening route, expected timeline and export-control implications. Do not treat nationality alone as a final decision.
• Is the external funding for this exact vacancy secured, and what conditions remain?
• Who will be main/co-supervisors, which programme/faculty registers this candidate, and what English evidence is accepted for a non-European MSc?
• Which use case and methodological directions are realistic within three years, and what partner/data permissions already exist? Confirm the deadline clock and submit the specified outline and materials.

At Interview

• How will technical AI-security work and human/organisational risk expertise be combined in supervision? Which data, equipment and participant access are approved for this post?
• How will ethics review, clearance and industrial confidentiality affect publication, thesis examination and reproducibility? What is the fallback if access is delayed?
• Which training courses and milestones are expected, and what constitutes satisfactory progression?

Before Accepting an Offer

• Confirm clearance-related appointment conditions and consequences of refusal/delay, funding duration and salary placement in writing.
• Confirm employee immigration instructions, tuition/administrative fees, relocation support and actual housing options; obtain current personal tax guidance and a household-specific budget.
• Check research/publication rights, any duty changes and whether international travel or research stays require additional approval.

Evidence and Sources

The available material does not establish current availability, personal clearance or export-control eligibility, a newly checked legal rule or current living costs. The three paper accounts retain their different abstract/selected-section reading limits and bibliographic date uncertainties; no new paper-body or supplementary-material reading is claimed. The documented Larsen/Haugli-Sandvik authorship link does not establish a legal name-change history.

Position, university and research environment

• S01 PhD Candidate in Cybersecurity Challenges in Maritime AI
• S02 Department of ICT and Natural Sciences: About us
• S03 Cyber-Physical Systems Laboratory
• S04 Norwegian Maritime AI Centre
• S05 MAI researchers and supervisors
• S06 MAI student projects 2026/27
• S07 MAI use cases
• S08 Marie Haugli-Sandvik staff profile
• S09 Rune Volden staff profile
• S10 Erlend Magnus Lervik Coates staff profile
• S14 PhD in Engineering: programme and admission

Original research and rankings

• S11 A model of factors influencing deck officers’ cyber risk perception in offshore operations
• S12 Maritime decision-makers and cyber security: deck officers’ perception of cyber risks towards IT and OT systems
• S13 SINDy-based modeling of an uncrewed surface vessel with experimental validation
• S15 QS NTNU university profile and ranking history
• S16 ShanghaiRanking NTNU institutional profile

Funding, costs, governance and career context

• S17 NTNU practical information: living in Alesund
• S18 Study in Norway: Cost and requirements
• S19 NSM: security clearance, access clearance and vetting
• S20 NSM: Authorisation of foreign citizens
• S21 IMO: Maritime cyber risk
• S22 DNV Maritime Cyber Priority 2024/25
• S23 Research Council of Norway maritime AI centre award results