Embedded Linux Security Engineer - Remote Work | REF#303892

BairesDev; Veracruz; Presencial; MXN 900.000 - 1.300.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

100% remote work

Excellent USD or local currency pay

Home setup provided

Flexible hours

Parental leaves and holidays

Global talent environment

Mentorship and growth opportunities

Descripción de la vacante

BairesDev is seeking an Embedded Linux Security Engineer to advance Secure Boot architecture from a hardware root of trust to the kernel, with a focus on embedded Linux security.

You will harden storage with dm-verity/dm-crypt, stand up a Trusted Execution Environment, enable OS-level sandboxing, and automate signing pipelines in CI/CD. This is a 100% remote role with compensation in USD or local currencies.

Formación

• 5+ years of experience in embedded Linux engineering with a security focus.
• Strong expertise in embedded Linux security, including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot from bootloader through kernel.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Responsabilidades

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications within the Linux security model.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

Conocimientos

Embedded Linux

Security engineering

C programming

Python scripting

English proficiency

Yocto

Herramientas

U-Boot

TrustZone

OP-TEE

dm-verity

dm-crypt

Descripción del empleo

At BairesDev®, we've been leading the way in technology projects for over 15 years. We deliver cutting-edge solutions to giants like Google and the most innovative startups in Silicon Valley.

Our diverse 4,000+ team, composed of the world's Top 1% of tech talent, works remotely on roles that drive significant impact worldwide.

When you apply for this position, you're taking the first step in a process that goes beyond the ordinary. We aim to align your passions and skills with our vacancies, setting you on a path to exceptional career development and success.

Embedded Linux Security Engineer at BairesDev

In this role, you'll go deep into the Linux security stack, building Secure Boot architecture from a hardware root of trust all the way through the kernel. Hardening storage, standing up a trusted execution environment, and enforcing sandboxing at the OS level, you'll apply Linux security expertise where the operating system itself is the attack surface being defended. This is your opportunity to specialize in embedded Linux security specifically, working on a platform where boot-time integrity and kernel-level protections define what the system can trust.

What You'll Do

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications within the Linux security model.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

What We Are Looking For

• 5+ years of experience in embedded Linux engineering with a security focus.
• Strong expertise in embedded Linux security, including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot from bootloader through kernel.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Nice To Have

• Experience with Linux sandboxing and MAC frameworks such as SELinux, AppArmor, cgroups, namespaces, or seccomp.
• Background with DevSecOps signing pipelines in CI/CD using GitLab CI or GitHub Actions with HSM or Key Vault.
• Experience with A/B partitioning and multi-slot boot recovery for fail-safe OTA.
• Solid cryptography foundations including asymmetric cryptography, SHA-256/384, PKI, and HSM.
• Experience with factory provisioning workflows including eFuse/OTP fuse burning and end-of-line testing.
• Automotive or ECU domain exposure.

How we do make your work (and your life) easier:

• 100% remote work (from anywhere).
• Excellent compensation in USD or your local currency if preferred
• Hardware and software setup for you to work from home.
• Flexible hours: create your own schedule.
• Paid parental leaves, vacations, and national holidays.
• Innovative and multicultural work environment: collaborate and learn from the global Top 1% of talent.
• Supportive environment with mentorship, promotions, skill development, and diverse growth opportunities.

Join a global team where your unique talents can truly thrive and make a significant impact!