Embedded Security Engineer: Hardware Root of Trust

RAPSYS TECHNOLOGIES PTE LTD; Foster City (CA); On-site; USD 140,000 - 180,000; Full time

Job summary

RAPSYS TECHNOLOGIES PTE LTD is seeking an Embedded Systems Security Engineer to harden an embedded Linux platform. You will bridge hardware security, kernel hardening, and secure user-space containment while automating security pipelines within CI/CD and coordinating with manufacturing for secure provisioning at scale.

You will design a Hardware Root of Trust, Secure Boot, and tamper-proof storage, build and maintain a TEE, and implement strict sandboxing and lifecycle security across devices.

Qualifications

• Bachelor's degree or equivalent practical experience in CS/engineering.
• 6+ years in Embedded Linux development, board bring-up, BSP customization.
• 3+ years deploying device security features in production hardware.
• Expertise with bootloaders and kernel storage/security subsystems.
• Deep understanding of ARM TrustZone architecture and security levels.
• Experience implementing SELinux/AppArmor policies and Linux containment tools.
• Proficiency in C and scripting in Python or Bash.

Responsibilities

• Design and implement Hardware Root of Trust and Secure Boot from first-stage bootloader through Linux kernel.
• Implement dm-verity and secure data encryption at rest for verified root filesystems.
• Develop, integrate, and maintain a TEE (OP-TEE) and Secure/TAs.
• Enforce containerization and sandboxing via SELinux, AppArmor, cgroups, namespaces, and seccomp.
• Build automated signing pipelines in CI/CD to sign bootloaders, kernels, and OTA payloads using HSMs/secure vaults.
• Collaborate with manufacturing to script eFuse/OTP programming and end-of-line security testing.
• Architect multi-slot boot recovery (A/B) for OTA-resilience.

Skills

Embedded Linux

Security engineering

Bootloaders / U-Boot

ARM TrustZone

SELinux / AppArmor

C programming

Python scripting

Education

Bachelor's degree in Computer Science / Engineering

Tools

U-Boot

Barebox

dm-verity

dm-crypt

Yocto Project

Buildroot

Git / CI/CD

OP-TEE

Job description

RAPSYS TECHNOLOGIES PTE LTD is seeking an Embedded Systems Security Engineer to harden an embedded Linux platform. You will bridge hardware security, kernel hardening, and secure user-space containment while automating security pipelines within CI/CD and coordinating with manufacturing for secure provisioning at scale.

You will design a Hardware Root of Trust, Secure Boot, and tamper-proof storage, build and maintain a TEE, and implement strict sandboxing and lifecycle security across devices.