Embedded Security Architect

Enphase Energy, Inc.; India; On-site; INR 3,000,000 - 5,500,000; Full time

Benefits offered by this job

Competitive compensation

Career growth opportunities

Job summary

Enphase Energy is seeking an experienced Embedded Security Architect to secure ARM-based IoT devices and the IQ Gateway/ Microinverter platforms. You will drive security-by-design across firmware, hardware, and cloud teams and own critical security components from boot to provisioning.

Join a global energy technology leader with a collaborative culture. This hybrid role requires onsite presence three days a week in India, with plans to move toward a full office schedule over time.

Qualifications

• 8+ years of embedded security or IoT security architecture experience.
• Expertise in ARM TrustZone, secure bootloaders, chain-of-trust, and hardware Root-of-Trust on ARM Cortex-A/M.
• Strong knowledge of TLS/mTLS, PKI, certificate lifecycle management, and secure communication protocol design.
• Familiarity with secure firmware signing and encrypted OTA update delivery.

Responsibilities

• Architect secure boot chains with a hardware-anchored root of trust — signed, staged bootloaders, anti-rollback counters, and eFuse/OTP provisioning using ARM TrustZone.
• Design hardware Root-of-Trust and device-identity provisioning and manage the key lifecycle from manufacturing through rotation.
• Build and maintain mutual-TLS and PKI frameworks — per-device certificates, certificate lifecycle, and secure key storage for authenticated device-to-cloud communication.
• Design secure OTA update architectures: signed and encrypted images, A/B partitioning, anti-rollback, and fail-safe recovery for the embedded fleet.
• Lead threat modeling (STRIDE) and risk assessments for large embedded fleets.
• Secure cloud-to-device trust across Enphase platforms and harden IoT communication protocols (BLE, Wi‑Fi, Ethernet, PLC).
• Define and enforce security-by-design standards and lead security architecture reviews across the embedded fleet.
• Collaborate with firmware, hardware, and cloud teams to drive security integration.

Skills

ARM TrustZone

Secure boot

Root-of-Trust

PKI TLS

C/C++

RTOS / Linux

Hardware crypto

IoT protocols

Threat modeling

Secure OTA

Key management

Education

BE/BTech/MS/MTech in Computer Science, Electrical Engineering, or related field

Job description

Enphase Energy is a global energy technology company and a leading provider of solar, battery, and electric vehicle charging products. Founded in 2006, our innovative microinverter technology revolutionized solar power, making it a safer, more reliable, and scalable energy source. Today, the Enphase Energy System enables users to make, use, save, and sell their own power. Enphase is also one of the most successful and innovative clean energy companies in the world, with more than 80 million products shipped across 160 countries.

Join our dynamic teams designing and developing next‑gen energy technologies and help drive a sustainable future!

This role at Enphase requires working onsite3 days a week, with plans to transition back to a full 5 day in office schedule over time.

About the role

Join Enphase Energy as an Embedded Security Architect and help secure the IQ Gateway and IQ Microinverter platforms—ARM‑based IoT devices that connect millions of solar homes worldwide via Wi‑Fi, Ethernet, and cellular networks with cloud‑managed OTA firmware delivery. In this role, you will drive security‑by‑design across embedded systems, working closely with firmware, cloud, and product teams to build highly secure and scalable energy solutions.

You will own critical security components such as secure boot chains, TrustZone partitioning, hardware Root‑of‑Trust, and cryptographic key provisioning across the fleet, ensuring robust, end‑to‑end device security.

What you will be doing

• Architect secure boot chains with a hardware‑anchored root of trust — signed, staged bootloaders, anti‑rollback counters, and eFuse/OTP provisioning — using ARM TrustZone to isolate secure and non‑secure worlds (TEE/OP‑TEE)
• Design hardware Root‑of‑Trust and device‑identity provisioning (secure elements, PUF, eFuse) and manage the key lifecycle from manufacturing through rotation and revocation
• Build and maintain mutual‑TLS and PKI frameworks — per‑device certificates, certificate lifecycle, and secure key storage for authenticated device‑to‑cloud communication
• Design secure OTA update architectures: signed and encrypted images, A/B partitioning, anti‑rollback, and fail‑safe recovery for the embedded fleet
• Lead threat modeling (STRIDE) and risk assessments, defining attack surfaces, abuse cases, and mitigations for large embedded fleets
• Securecloud‑to‑device trust across Enphase platforms (e.g., app and cloud ecosystems)
• Drive security integration across firmware, hardware, and cloud teams
• Harden IoT communication protocols across BLE, Wi‑Fi (802.11), Ethernet, and PLC/powerline interfaces
• Define and enforce security‑by‑design standards and lead security architecture reviews across the embedded fleet

Who you are and what you bring

• BE/BTech/MS/MTech in Computer Science, Electrical Engineering, or a related field.
• 8+ years of experience in embedded security or IoT security architecture
• Expertise in ARM TrustZone (TEE/OP‑TEE), secure bootloaders, chain‑of‑trust, and hardware Root‑of‑Trust on ARM Cortex‑A/M
• Experience with HSM/TPM integration, secure elements, and cryptographic key management (AES, RSA, ECC, hardware crypto accelerators)
• Strong knowledge of TLS/mTLS, PKI, certificate lifecycle management, and secure communication protocol design
• Familiarity with IoT protocols: BLE, Wi‑Fi (802.11), Ethernet, and PLC/powerline communication
• Knowledge of security standards: IEC 62443, ETSI EN 303 645, EU Cyber Resilience Act
• Experience embedding security‑by‑design in partnership with firmware, cloud, and product security teams
• Familiarity with secure firmware signing and encrypted, authenticated OTA update delivery
• Strong problem‑solving skills with the ability to thrive in a fast‑paced, cross‑functional environment
• Proficiency in C/C++ and embedded development on RTOS and embedded Linux for ARM Cortex‑A/M targets

Nice to have

• Experience designing secure OTA update pipelines for large device fleets
• Familiarity with side‑channel analysis and hardware fault‑injection countermeasures
• Relevant certifications such as CISSP‑ISSAP, GPEN, or GXPN

What we offer

• Competitive compensation and comprehensive employee benefits
• Opportunity to architect security for large‑scale global IoT energy systems
• Exposure to cutting‑edge technologies in embedded and IoT security
• Collaborative and innovation‑driven work environment
• Career growth and development opportunities