Embedded Linux Security Engineer - Remote Work | REF#302387

BairesDev; Brasil; Remote; BRL 657,000 - 986,000; Full time

Benefits offered by this job

100% remote work

Competitive USD or local currency

Home office setup provided

Flexible hours

Paid parental leave

Mentorship and growth opportunities

Job summary

BairesDev is seeking an Embedded Linux Security Engineer to join our fully remote team. You’ll dive into the Linux security stack, building Secure Boot from hardware root of trust through the kernel and hardening the storage stack.

You’ll stand up a Trusted Execution Environment, enforce sandboxing, and automate signing pipelines in CI/CD, contributing to a platform where boot-time integrity defines trust. Excellent English and strong C skills with Python or Bash, plus Yocto BSP experience and

Qualifications

• 5+ years of embedded Linux engineering with a security focus.
• Deep expertise in embedded Linux security including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot end-to-end (U-Boot Verified Boot).
• Experience with board bring-up and BSP customization using Yocto.
• Experience with TEE development and OP-TEE for trusted apps.

Responsibilities

• Build Secure Boot architecture on embedded Linux from hardware root of trust to kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and trusted apps within Linux security model.
• Enforce Linux user-space sandboxing and access control.
• Automate signing pipelines in CI/CD against a signing backend.

Skills

Embedded Linux security

C programming

Python or Bash scripting

English proficiency

Tools

Yocto BSP

OP-TEE

U-Boot Verified Boot

ARM TrustZone

Job description

At BairesDev®, we've been leading the way in technology projects for over 15 years. We deliver cutting-edge solutions to giants like Google and the most innovative startups in Silicon Valley.

Our diverse 4,000+ team, composed of the world's Top 1% of tech talent, works remotely on roles that drive significant impact worldwide.

When you apply for this position, you're taking the first step in a process that goes beyond the ordinary. We aim to align your passions and skills with our vacancies, setting you on a path to exceptional career development and success.

Embedded Linux Security Engineer at BairesDev

In this role, you'll go deep into the Linux security stack, building Secure Boot architecture from a hardware root of trust all the way through the kernel. Hardening storage, standing up a trusted execution environment, and enforcing sandboxing at the OS level, you'll apply Linux security expertise where the operating system itself is the attack surface being defended. This is your opportunity to specialize in embedded Linux security specifically, working on a platform where boot-time integrity and kernel-level protections define what the system can trust.

What You'll Do

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications within the Linux security model.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

What We Are Looking For

• 5+ years of experience in embedded Linux engineering with a security focus.
• Strong expertise in embedded Linux security, including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot from bootloader through kernel.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Nice To Have

• Experience with Linux sandboxing and MAC frameworks such as SELinux, AppArmor, cgroups, namespaces, or seccomp.
• Background with DevSecOps signing pipelines in CI/CD using GitLab CI or GitHub Actions with HSM or Key Vault.
• Experience with A/B partitioning and multi-slot boot recovery for fail-safe OTA.
• Solid cryptography foundations including asymmetric cryptography, SHA-256/384, PKI, and HSM.
• Experience with factory provisioning workflows including eFuse/OTP fuse burning and end-of-line testing.
• Automotive or ECU domain exposure.

How we do make your work (and your life) easier:

• 100% remote work (from anywhere).
• Excellent compensation in USD or your local currency if preferred
• Hardware and software setup for you to work from home.
• Flexible hours: create your own schedule.
• Paid parental leaves, vacations, and national holidays.
• Innovative and multicultural work environment: collaborate and learn from the global Top 1% of talent.
• Supportive environment with mentorship, promotions, skill development, and diverse growth opportunities.

Join a global team where your unique talents can truly thrive and make a significant impact!