Embedded Linux Security Engineer - Remote Work | REF#308959

BairesDev; São Paulo; Remote; BRL 657,000 - 1,041,000; Full time

Benefits offered by this job

Remote work

USD or local currency

Equipment provided

Flexible hours

Parental leave

Career growth

Job summary

BairesDev is seeking an Embedded Linux Security Engineer to join our 100% remote team. You will design and implement Secure Boot architectures, harden storage with dm-verity/dm-crypt, and build a Trusted Execution Environment with OP-TEE across embedded Linux platforms.

You will work on boot-time integrity, kernel protections, and SELinux-like sandboxing, while automating cryptographic signing in CI/CD. Strong security focus and C/Python skills are required for global impact.

Qualifications

• 5+ years in embedded Linux engineering with a security focus.
• Expertise in embedded Linux security: dm-verity, dm-crypt, ARM TrustZone EL1-EL3.
• Experience designing hardware root of trust and Secure Boot from scratch.
• Experience with U-Boot Verified Boot across bootloader to kernel.
• Board bring-up and BSP customization with Yocto.
• TEE development and trusted app authoring with OP-TEE.
• Strong C skills; Python or Bash scripting experience.
• Advanced English proficiency.

Responsibilities

• Build Secure Boot architecture on embedded Linux from hardware root to kernel.
• Harden storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and trusted apps.
• Enforce Linux user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

Skills

Embedded Linux

Linux security

Hardware root of trust

Secure Boot

U-Boot

Yocto

OP-TEE

C programming

Python scripting

Bash scripting

English proficiency

Job description

At BairesDev®, we've been leading the way in technology projects for over 15 years. We deliver cutting-edge solutions to giants like Google and the most innovative startups in Silicon Valley.

Our diverse 4,000+ team, composed of the world's Top 1% of tech talent, works remotely on roles that drive significant impact worldwide.

When you apply for this position, you're taking the first step in a process that goes beyond the ordinary. We aim to align your passions and skills with our vacancies, setting you on a path to exceptional career development and success.

Embedded Linux Security Engineer at BairesDev

In this role, you'll go deep into the Linux security stack, building Secure Boot architecture from a hardware root of trust all the way through the kernel. Hardening storage, standing up a trusted execution environment, and enforcing sandboxing at the OS level, you'll apply Linux security expertise where the operating system itself is the attack surface being defended. This is your opportunity to specialize in embedded Linux security specifically, working on a platform where boot-time integrity and kernel-level protections define what the system can trust.

What You'll Do

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications within the Linux security model.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

What We Are Looking For

• 5+ years of experience in embedded Linux engineering with a security focus.
• Strong expertise in embedded Linux security, including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot from bootloader through kernel.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Nice To Have

• Experience with Linux sandboxing and MAC frameworks such as SELinux, AppArmor, cgroups, namespaces, or seccomp.
• Background with DevSecOps signing pipelines in CI/CD using GitLab CI or GitHub Actions with HSM or Key Vault.
• Experience with A/B partitioning and multi-slot boot recovery for fail-safe OTA.
• Solid cryptography foundations including asymmetric cryptography, SHA-256/384, PKI, and HSM.
• Experience with factory provisioning workflows including eFuse/OTP fuse burning and end-of-line testing.
• Automotive or ECU domain exposure.

How we do make your work (and your life) easier:

• 100% remote work (from anywhere).
• Excellent compensation in USD or your local currency if preferred
• Hardware and software setup for you to work from home.
• Flexible hours: create your own schedule.
• Paid parental leaves, vacations, and national holidays.
• Innovative and multicultural work environment: collaborate and learn from the global Top 1% of talent.
• Supportive environment with mentorship, promotions, skill development, and diverse growth opportunities.

Join a global team where your unique talents can truly thrive and make a significant impact!