Embedded Systems Security Engineer

About the role

HireArt is helping an on-demand, autonomous ride-hailing company find an Embedded Systems Security Engineer to develop and implement security solutions that harden the next generation of our embedded Linux platform. In this role, you'll design and deploy security features spanning hardware, firmware, and software, from secure boot and trusted execution environments to kernel hardening and application isolation. You'll also automate security workflows within the CI/CD pipeline and partner with manufacturing teams to ensure devices are securely provisioned and production-ready at scale.

Responsibilities

• Design and implement Hardware Root of Trust and Secure Boot architectures from the first-stage bootloader through the Linux kernel
• Implement cryptographically verified storage solutions, including dm-verity for read-only root filesystems and encryption for data at rest
• Develop and maintain Trusted Execution Environment (TEE) solutions, such as OP-TEE, and author Trusted Applications (TAs)
• Implement user-space isolation and sandboxing using technologies such as SELinux, AppArmor, cgroups, namespaces, and seccomp
• Build automated cryptographic signing pipelines within CI/CD environments to securely sign bootloaders, kernels, and over-the-air (OTA) update payloads using hardware security modules (HSMs) or secure key vaults
• Partner with manufacturing teams to develop secure provisioning tools, including eFuse/OTP programming and end-of-line validation software
• Design resilient boot and recovery architectures, including A/B partitioning strategies, to ensure reliable system recovery from failed updates or corrupted boots

Requirements

• A bachelor's degree in computer science, computer engineering, electrical engineering, or a related technical discipline, or equivalent practical experience
• 6+ years of experience in embedded Linux development, board bring-up, and Board Support Package (BSP) customization
• 3+ years of hands-on experience implementing device-level security features in production embedded systems
• Expert knowledge of bootloaders such as U-Boot Verified Boot, or Barebox, and Linux security technologies including dm-crypt and dm-verity
• Deep understanding of ARM TrustZone security architecture (ARMv7-A/ARMv8-A) and processor privilege levels
• Experience developing and maintaining SELinux or AppArmor policies, along with Linux containment technologies including cgroups, namespaces, and seccomp
• Proficiency with embedded Linux build systems such as the Yocto Project (BitBake) or Buildroot
• Advanced programming skills in C and strong scripting experience with Python or Bash

Preferred qualifications

• Strong understanding of cryptographic algorithms, public key infrastructure (PKI), and Hardware Security Modules (HSMs)
• Experience working with contract manufacturers or internal production teams to implement secure key injection and hardware provisioning processes
• Experience with embedded container runtimes such as LXC, crun, or similar lightweight sandboxing technologies
• Experience designing secure OTA update strategies, including hardware-enforced anti-rollback protection and version management

Benefits

• Pre-tax commuter benefits
• Employer (HireArt) subsidized healthcare benefits (eligibility begins on the first of the month following 60 days of service)
• Flexible Spending Account for healthcare-related costs
• HireArt covers all costs for short- and long-term disability and life insurance
• 401k package

Commitment: This is a full-time, ongoing contract position staffed via HireArt. It will be onsite and available to candidates who are local to the Foster City, CA area.

This response is AI-generated, for reference only.