Senior Platform Engineer, Embedded Linux & Security

Senior Platform Engineer, Embedded Linux & Security

About the role

This role secures embedded Linux devices and the infrastructure behind them, from boot and provisioning through release, deployment, and cloud services. You'll join a small engineering team as a senior individual contributor, working across device security, DevOps, and backend development.

What you'll do

• Work with and improve secure device provisioning and hardware-backed security, including fusing, signing, device identity, secure boot, attestation, and disk encryption.
• Help define and harden software release processes from source to device.
• Help design device authentication and authorization services.
• Harden device images and container runtimes, including mandatory access control such as AppArmor or SELinux.
• Run services with least privilege: systemd sandboxing, non-root accounts, and correct file ownership and permissions.
• Set SSH and firewall policy, and close debug paths such as UART, JTAG, and USB recovery.
• Secure web services on devices and in the cloud with TLS and mTLS, reverse proxies, and least-privilege service accounts.
• Threat model the platform, help scope pentests, and track vulnerabilities.
• Plan security for partner engagements and third-party integrations: define requirements, review interfaces and data flows, and set access boundaries.
• Help shape fleet management and over-the-air update approaches, from device enrollment through deployment.
• Build cloud pipelines for device data and identity, with least-privilege access scoped to each device.
• Contribute to arm64 build and image pipelines, including cross-compilation, QEMU-based builds and tests, multi-arch containers, and rootfs customization.
• Write and maintain backend code for device and infrastructure tooling.

What you bring

• 6+ years of experience across Linux systems, security, and infrastructure engineering.
• Strong working knowledge of hardware-backed security: secure boot chains, fused keys, TPMs and firmware TPMs, TEEs, attestation, and sealed storage.
• Hands-on experience hardening Linux devices, containers, and services, with fluency in permissions, capabilities, and systemd.
• Current knowledge of how to secure edge and IoT devices, such as A/B partitions, read-only root filesystems, and verified boot.
• Confidence building and securing cloud infrastructure and CI/CD pipelines.
• Solid coding skills for tooling and backend services, and the ability to review code for security issues.
• Experience threat modeling systems and working with penetration testers or red teams.
• A bias toward action: delivering on priorities with urgency, and proactively finding, raising, and fixing issues with the team along the way.

Nice to have

• Hands-on implementation of secure boot, key fusing, or attestation on embedded hardware
• Hands-on implementation of secure OTA updates, including fleet update tools such as Mender
• ML model security on edge devices: current risks and mitigations
• Embedded pentesting or red team work: UART and JTAG access, firmware extraction, rollback and recovery-mode attacks
• Cloud security depth: serverless, IAM policy design, key management, device identity
• Infrastructure as code with tools such as Terraform or Ansible
• C++, Python
• Experience in defense, export-controlled, or CMMC-regulated environments
• Experience in a small, fast-paced startup environment
• Familiarity with corporate security and IT infrastructure