Embedded Linux Security Engineer - Remote Work | REF#303892

BairesDev; Veracruz; A distancia; MXN 2.063.000 - 3.095.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Remote work

USD or local currency compensation

Home hardware & software setup

Descripción de la vacante

BairesDev is hiring a skilled Embedded Linux Security Engineer to join a 100% remote team. You will design and implement Secure Boot, hardware root of trust, and kernel-level protections for embedded Linux systems.

Expect to harden storage with dm-verity/dm-crypt, establish a trusted execution environment, and automate signing pipelines within CI/CD. Ideal candidates have 5+ years in embedded Linux security, experience with Yocto, OP-TEE, and ARM TrustZone, plus strong C and scripting skills and

Formación

• 5+ years of embedded Linux engineering with a security focus.
• Proven experience with dm-verity, dm-crypt, and ARM TrustZone.
• Design hardware root of trust and Secure Boot from scratch.
• Yocto BSP bring-up and board initialization.

Responsabilidades

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and trusted applications.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

Conocimientos

Embedded Linux

Secure Boot

Yocto BSP

C/Python scripting

English proficiency

Herramientas

dm-verity

dm-crypt

ARM TrustZone

OP-TEE

U-Boot

Descripción del empleo

At BairesDev, we've been leading the way in technology projects for over 15 years. We deliver cutting-edge solutions to giants like Google and the most innovative startups in Silicon Valley.

Our diverse 4,000+ team, composed of the world's Top 1% of tech talent, works remotely on roles that drive significant impact worldwide.

When you apply for this position, you're taking the first step in a process that goes beyond the ordinary. We aim to align your passions and skills with our vacancies, setting you on a path to exceptional career development and success.

Embedded Linux Security Engineer at BairesDev

In this role, you'll go deep into the Linux security stack, building Secure Boot architecture from a hardware root of trust all the way through the kernel. Hardening storage, standing up a trusted execution environment, and enforcing sandboxing at the OS level, you'll apply Linux security expertise where the operating system itself is the attack surface being defended. This is your opportunity to specialize in embedded Linux security specifically, working on a platform where boot-time integrity and kernel-level protections define what the system can trust.

What You'll Do

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications within the Linux security model.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

What We Are Looking For

• 5+ years of experience in embedded Linux engineering with a security focus.
• Strong expertise in embedded Linux security, including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot from bootloader through kernel.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Nice To Have

• Experience with Linux sandboxing and MAC frameworks such as SELinux, AppArmor, cgroups, namespaces, or seccomp.
• Background with DevSecOps signing pipelines in CI/CD using GitLab CI or GitHub Actions with HSM or Key Vault.
• Experience with A/B partitioning and multi-slot boot recovery for fail-safe OTA.
• Solid cryptography foundations including asymmetric cryptography, SHA-256/384, PKI, and HSM.
• Experience with factory provisioning workflows including eFuse/OTP fuse burning and end-of-line testing.
• Automotive or ECU domain exposure.

How we do make your work (and your life) easier:

• 100% remote work (from anywhere).
• Excellent compensation in USD or your local currency if preferred
• Hardware and software setup for you to work from home.
• Flexible hours: create your own schedule.
• Paid parental leaves, vacations, and national holidays.
• Innovative and multicultural work environment: collaborate and learn from the global Top 1% of talent.
• Supportive environment with mentorship, promotions, skill development, and diverse growth opportunities.

Join a global team where your unique talents can truly thrive and make a significant impact!