Embedded Linux Security Engineer - Remote Work | REF#302389

BairesDev; Lima Metropolitana; Remote; PEN 412,000 - 584,000; Full time

Benefits offered by this job

100% remote work

Flexible hours

Work from home setup

Paid parental leave

Job summary

BairesDev is seeking an Embedded Linux Security Engineer to specialize in secure boot, trusted execution environments, and kernel-level protections. You will work on embedded Linux platforms with hardware-root trust and modern security features.

Join a global, 100% remote team delivering cutting-edge projects. The role emphasizes Bring-Up, BSP customization with Yocto, OPS/TEE, and strong C skills alongside scripting in Python or Bash. Fluency in English is required.

Qualifications

• 5+ years of embedded Linux engineering with a security focus.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Responsibilities

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications within the Linux security model.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

Skills

Embedded Linux security

C programming

Python scripting

Bash scripting

U-Boot/Verified Boot

Yocto BSP

OP-TEE

ARM TrustZone

English proficiency

Tools

dm-verity

dm-crypt

TrustZone

Job description

At BairesDev®, we've been leading the way in technology projects for over 15 years. We deliver cutting-edge solutions to giants like Google and the most innovative startups in Silicon Valley. Our diverse 4,000+ team, composed of the world's Top 1% of tech talent, works remotely on roles that drive significant impact worldwide. When you apply for this position, you're taking the first step in a process that goes beyond the ordinary. We aim to align your passions and skills with our vacancies, setting you on a path to exceptional career development and success.

Embedded Linux Security Engineer at BairesDev

In this role, you'll go deep into the Linux security stack, building Secure Boot architecture from a hardware root of trust all the way through the kernel. Hardening storage, standing up a trusted execution environment, and enforcing sandboxing at the OS level, you'll apply Linux security expertise where the operating system itself is the attack surface being defended. This is your opportunity to specialize in embedded Linux security specifically, working on a platform where boot-time integrity and kernel-level protections define what the system can trust.

What You'll Do

• Build Secure Boot architecture on embedded Linux, from hardware root of trust through the kernel.
• Harden the Linux storage stack using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications within the Linux security model.
• Enforce Linux-level user-space sandboxing and access control.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

What We Are Looking For

• 5+ years of experience in embedded Linux engineering with a security focus.
• Strong expertise in embedded Linux security, including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot from bootloader through kernel.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Nice To Have

• Experience with Linux sandboxing and MAC frameworks such as SELinux, AppArmor, cgroups, namespaces, or seccomp.
• Background with DevSecOps signing pipelines in CI/CD using GitLab CI or GitHub Actions with HSM or Key Vault.
• Experience with A/B partitioning and multi-slot boot recovery for fail-safe OTA.
• Solid cryptography foundations including asymmetric cryptography, SHA-256/384, PKI, and HSM.
• Experience with factory provisioning workflows including eFuse/OTP fuse burning and end-of-line testing.
• Automotive or ECU domain exposure.

How we do make your work (and your life) easier:

• 100% remote work (from anywhere).
• Excellent compensation in USD or your local currency if preferred
• Hardware and software setup for you to work from home.
• Flexible hours: create your own schedule.
• Paid parental leaves, vacations, and national holidays.
• Innovative and multicultural work environment: collaborate and learn from the global Top 1% of talent.
• Supportive environment with mentorship, promotions, skill development, and diverse growth opportunities.

Join a global team where your unique talents can truly thrive and make a significant impact!