Senior Platform Engineer, Embedded Linux & Security

SENIOR PLATFORM ENGINEER, EMBEDDED LINUX & SECURITY ABOUT THE ROLE This role secures embedded Linux devices and the infrastructure behind them, from boot and provisioning through release, deployment, and cloud services. You'll join a small engineering team as a senior individual contributor, working across device security, DevOps, and backend development. WHAT YOU'LL DO - Work with and improve secure device provisioning and hardware-backed security, including fusing, signing, device identity, secure boot, attestation, and disk encryption. - Help define and harden software release processes from source to device. - Help design device authentication and authorization services. - Harden device images and container runtimes, including mandatory access control such as AppArmor or SELinux. - Run services with least privilege: systemd sandboxing, non-root accounts, and correct file ownership and permissions. - Set SSH and firewall policy, and close debug paths such as UART, JTAG, and USB recovery. - Secure web services on devices and in the cloud with TLS and mTLS, reverse proxies, and least-privilege service accounts. - Threat model the platform, help scope pentests, and track vulnerabilities. - Plan security for partner engagements and third-party integrations: define requirements, review interfaces and data flows, and set access boundaries. - Help shape fleet management and over-the-air update approaches, from device enrollment through deployment. - Build cloud pipelines for device data and identity, with least-privilege access scoped to each device. - Contribute to arm64 build and image pipelines, including cross-compilation, QEMU-based builds and tests, multi-arch containers, and rootfs customization. - Write and maintain backend code for device and infrastructure tooling. WHAT YOU BRING - 6+ years of experience across Linux systems, security, and infrastructure engineering. - Strong working knowledge of hardware-backed security: secure boot chains, fused keys, TPMs and firmware TPMs, TEEs, attestation, and sealed storage. - Hands-on experience hardening Linux devices, containers, and services, with fluency in permissions, capabilities, and systemd. - Current knowledge of how to secure edge and IoT devices, such as A/B partitions, read-only root filesystems, and verified boot. - Confidence building and securing cloud infrastructure and CI/CD pipelines. - Solid coding skills for tooling and backend services, and the ability to review code for security issues. - Experience threat modeling systems and working with penetration testers or red teams. - A bias toward action: delivering on priorities with urgency, and proactively finding, raising, and fixing issues with the team along the way. NICE TO HAVE - Hands-on implementation of secure boot, key fusing, or attestation on embedded hardware - Hands-on implementation of secure OTA updates, including fleet update tools such as Mender - ML model security on edge devices: current risks and mitigations - Embedded pentesting or red team work: UART and JTAG access, firmware extraction, rollback and recovery-mode attacks - Cloud security depth: serverless, IAM policy design, key management, device identity - Infrastructure as code with tools such as Terraform or Ansible - C++, Python - Experience in defense, export-controlled, or CMMC-regulated environments - Experience in a small, fast-paced startup environment - Familiarity with corporate security and IT infrastructure