Embedded Systems Security Engineer

Expected compensation: 99.26 USD Per Hour

Hire Art is helping an on-demand, autonomous ride-hailing company find an Embedded Systems Security Engineer to develop and implement security solutions that harden the next generation of our embedded Linux platform.

In this role, you’ll design and deploy security features spanning hardware, firmware, and software, from secure boot and trusted execution environments to kernel hardening and application isolation. You'll also automate security workflows within the CI/CD pipeline and partner with manufacturing teams to ensure devices are securely provisioned and production-ready at scale.

The ideal candidate is an experienced embedded systems engineer with deep expertise in Linux security, secure boot architectures, and hardware root of trust implementations. They are equally comfortable developing low-level security features, automating security processes, and collaborating across engineering and manufacturing teams.

• Design and implement Hardware Root of Trust and Secure Boot architectures from the first-stage boot loader through the Linux kernel.
• Implement cryptographically verified storage solutions, including dm-verity for read-only root file systems and encryption for data at rest.
• Develop and maintain Trusted Execution Environment (TEE) solutions, such as OP-TEE, and author Trusted Applications (TAs).
• Implement user-space isolation and sandboxing using technologies such as SELinux, App Armor, cgroups, name spaces, and seccomp.
• Build automated cryptographic signing pipelines within CI/CD environments to securely sign bootloaders, kernels, and over-the-air (OTA) update payloads using hardware security modules (HSMs) or secure key vaults.
• Partner with manufacturing teams to develop secure provisioning tools, including eFuse/OTP programming and end-of-line validation software.
• Design resilient boot and recovery architectures, including A/B partitioning strategies, to ensure reliable system recovery from failed updates or corrupted boots.

• A bachelor's degree in computer science, computer engineering, electrical engineering, or a related technical discipline, or equivalent practical experience
• 6+ years of experience in embedded Linux development, board bring-up, and Board Support Package (BSP) customization
• 3+ years of hands‑on experience implementing device-level security features in production embedded systems
• Expert knowledge of bootloaders such as U-Boot Verified Boot, or Barebox, and Linux security technologies including dm-crypt and dm-verity
• Deep understanding of ARM Trust Zone security architecture (ARMv7-A/ARMv8-A) and processor privilege levels
• Experience developing and maintaining SELinux or App Armor policies, along with Linux containment technologies including cgroups, name spaces, and seccomp
• Proficiency with embedded Linux build systems such as the Yocto Project (Bit Bake) or Buildroot
• Advanced programming skills in C and strong scripting experience with Python or Bash

• Strong understanding of cryptographic algorithms, public key infrastructure (PKI), and Hardware Security Modules (HSMs)
• Experience working with contract manufacturers or internal production teams to implement secure key injection and hardware provisioning processes
• Experience with embedded container runtimes such as LXC, crun, or similar lightweight sandboxing technologies
• Experience designing secure OTA update strategies, including hardware-enforced anti-rollback protection and version management

• Pre‑tax commuter benefits
• Employer (Hire Art) subsidized healthcare benefits (eligibility begins on the first of the month following 60 days of service)
• Flexible Spending Account for healthcare‑related costs
• Hire Art covers all costs for short- and long-term disability and life insurance
• 401k package

This is a full‑time, ongoing contract position staffed via Hire Art. It will be onsite and available to candidates who are local to the Foster City, CA area.

Hire Art values diversity and is an Equal Opportunity Employer. We are interested in every qualified candidate who is eligible to work in the United States. Unfortunately, we are not able to sponsor visas or employ corp‑to‑corp.