Embedded Linux Security Engineer - Hardware Trust

Kforce Inc; San Mateo (CA); On-site; USD 150,000 - 210,000; Full time

Benefits offered by this job

Medical/dental/vision insurance

401(k)

Paid time off

HSA/FSA

Job summary

Kforce has a client in Foster City, CA seeking an Embedded Systems Security Engineer to harden a next-generation embedded Linux platform. You will bridge hardware security, kernel hardening, and secure user-space containment.

You will design cryptographic defenses, automate security pipelines in CI/CD, and partner with manufacturing to provision devices securely at scale, focusing on TrustZone, secure boot, and robust runtime protection.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, Electrical Engineering, or equivalent.
• 6+ years of Embedded Linux development, board bring-up, and BSP customization.
• 3+ years deploying device-level security features into production hardware.
• Expert knowledge of bootloader configurations (e.g., U-Boot/Barebox) and Linux kernel storage/security subsystems (dm-crypt, dm-verity).
• Deep understanding of ARM TrustZone (ARMv7-A/ARMv8-A, EL1-EL3).
• Proficiency with SELinux/AppArmor, cgroups, namespaces.
• Yocto Project (BitBake) or Buildroot build automation experience.
• Advanced C and scripting (Python or Bash).

Responsibilities

• Design and implement Hardware Root of Trust and Secure Boot from bootloader to kernel.
• Implement dm-verity and encryption for root filesystem and data at rest.
• Develop and integrate a TEE (OP-TEE) and Secure/Trusted Applications.
• Enforce user-space isolation with SELinux, AppArmor, cgroups, namespaces, seccomp.
• Build automated cryptographic signing pipelines in CI/CD with GitLab/GitHub Actions and HSMs.
• Collaborate with manufacturing to burn fuses securely and validate security features at end-of-line testing.
• Architect multi-slot boot recovery layouts to ensure OTA resilience.

Skills

Embedded Linux

Board Bring-up

BSP customization

C programming

Python scripting

Security features

CI/CD automation

Kernel hardening

Education

Bachelor's degree in Computer Science/Engineering

Tools

Yocto Project

Buildroot

OP-TEE

SELinux

dm-verity

Job description

Kforce has a client in Foster City, CA seeking an Embedded Systems Security Engineer to harden a next-generation embedded Linux platform. You will bridge hardware security, kernel hardening, and secure user-space containment.

You will design cryptographic defenses, automate security pipelines in CI/CD, and partner with manufacturing to provision devices securely at scale, focusing on TrustZone, secure boot, and robust runtime protection.