Senior Platform Engineer, Embedded Linux & Security

SENIOR PLATFORM ENGINEER, EMBEDDED LINUX & SECURITY

ABOUT THE ROLE

This role secures embedded Linux devices and the infrastructure behind them, from boot and provisioning through release, deployment, and cloud services. You'll join a small engineering team as a senior individual contributor, working across device security, DevOps, and backend development.

WHAT YOU'LL DO

- Work with and improve secure device provisioning and hardware-backed security, including fusing, signing, device identity, secure boot, attestation, and disk encryption.

- Help define and harden software release processes from source to device.

- Help design device authentication and authorization services.

- Harden device images and container runtimes, including mandatory access control such as AppArmor or SELinux.

- Run services with least privilege: systemd sandboxing, non-root accounts, and correct file ownership and permissions.

- Set SSH and firewall policy, and close debug paths such as UART, JTAG, and USB recovery.

- Secure web services on devices and in the cloud with TLS and mTLS, reverse proxies, and least-privilege service accounts.

- Threat model the platform, help scope pentests, and track vulnerabilities.

- Plan security for partner engagements and third-party integrations: define requirements, review interfaces and data flows, and set access boundaries.

- Help shape fleet management and over-the-air update approaches, from device enrollment through deployment.

- Build cloud pipelines for device data and identity, with least-privilege access scoped to each device.

- Contribute to arm64 build and image pipelines, including cross-compilation, QEMU-based builds and tests, multi-arch containers, and rootfs customization.

- Write and maintain backend code for device and infrastructure tooling.

WHAT YOU BRING

- 6+ years of experience across Linux systems, security, and infrastructure engineering.

- Strong working knowledge of hardware-backed security: secure boot chains, fused keys, TPMs and firmware TPMs, TEEs, attestation, and sealed storage.

- Hands-on experience hardening Linux devices, containers, and services, with fluency in permissions, capabilities, and systemd.

- Current knowledge of how to secure edge and IoT devices, such as A/B partitions, read-only root filesystems, and verified boot.

- Confidence building and securing cloud infrastructure and CI/CD pipelines.

- Solid coding skills for tooling and backend services, and the ability to review code for security issues.

- Experience threat modeling systems and working with penetration testers or red teams.

- A bias toward action: delivering on priorities with urgency, and proactively finding, raising, and fixing issues with the team along the way.

NICE TO HAVE

- Hands-on implementation of secure boot, key fusing, or attestation on embedded hardware

- Hands-on implementation of secure OTA updates, including fleet update tools such as Mender

- ML model security on edge devices: current risks and mitigations

- Embedded pentesting or red team work: UART and JTAG access, firmware extraction, rollback and recovery-mode attacks

- Cloud security depth: serverless, IAM policy design, key management, device identity

- Infrastructure as code with tools such as Terraform or Ansible

- C++, Python

- Experience in defense, export-controlled, or CMMC-regulated environments

- Experience in a small, fast-paced startup environment

- Familiarity with corporate security and IT infrastructure