Senior Staff Software Engineer - Secure Manufacturing

About the role

We’re scaling from prototypes to manufacturing, and the process maturity needs to match. This role owns the secure manufacturing pipeline — the procedures, tooling, and controls that take a bare board in an untrusted CM facility and turn it into a cryptographically enrolled, OTA-ready device that our cloud fleet trusts. You’ll be the bridge between our secure boot/firmware teams and the cloud control plane, connecting them at the point of manufacture.

Responsibilities

• Design the secure manufacturing station — Architect the hardware, software, and network stack (HSM, key injection, AWS Private CA) for factory floor provisioning stations. Integrate the secure boot fuse/flashing flow from our secure boot/firmware team.
• Build the provisioning toolchain — Own the automation pipeline that takes a bare device through identity provisioning, enrollment, firmware flashing, calibration, and functional test.
• Bridge device and cloud identity — Enroll every device into a registry with correct credentials for OTA, session heartbeating, and deployment tracking.
• Own the End-Of-Line (EOL) test framework — Work with globally distributed teams to define pass/fail criteria for devices leaving the line: sensor calibration, actuator checks, and initial OTA health check.
• Work with contract manufacturers — Translate security requirements into CM-executable procedures; threat-model the factory for key leakage, firmware tampering, and supply chain substitution.
• Maintain chain of custody — Link each physical serial number to its provisioned identity, calibration records, test results, and firmware version at manufacture.
• Collaborate across teams — Work daily with a globally distributed team of firmware, cloud, manufacturing, systems and operational team members.

Requirements

• 10+ years in manufacturing engineering, with a comparable depth of experience developing test tools and frameworks.
• 5+ years working with networking in a manufacturing environment, and 3+ years focused on secure device provisioning and/or secure manufacturing processes.
• Ideally 3 years at a Staff level or equivalent.
• PKI and device identity — Experience with X.509 certificate lifecycles, mTLS, device authentication and attestation, and managed CA services like AWS Private CA.
• AWS infrastructure — S3, IAM, ECS, KMS, CloudHSM and Secrets Manager for secure provisioning workflows.
• EOL test and calibration — Hands-on experience defining manufacturing test frameworks, experience with hardware test fixtures.
• Scripting and automation — Advanced skills in Python or Bash for developing production-grade provisioning toolchains.
• Advanced skills and understanding of Rust, Bazel, Systemd.
• Embedded Linux systems — Experience with NVIDIA Jetson Orin/Thor platforms.
• Secure manufacturing design — Ability to design secure processes for untrusted or semi-trusted offshore CMs and air-gapped station design.
• Experience managing quality gates with contract manufacturers.
• Hardware root of trust understanding — General understanding of secure boot chains, TPM/TrustZone, cryptographic key injection, certificate provisioning, and eFuse programming.

Benefits

• Comprehensive health coverage for US-based employees, including fully paid medical, dental, and vision insurance, with virtual care and employee assistance resources.
• Meaningful time off to rest and recharge: 23 days of PTO (accrued), separate sick leave, and paid company holidays.
• 401(k) retirement plan with employer match.
• Equity included — we believe builders should share in what they build.
• Free daily catered lunch, snacks, and drinks in-office.
• Collaboration with top-tier engineers, researchers, and product experts in AI and robotics.
• Freedom to influence the product and own key initiatives.

Pay

For this role in California, the expected base salary range is $260,000–$320,000 USD per year; your placement in that range depends on how your experience maps to our internal leveling.