Embedded Security Engineer: HSMs, PKCS#11 & Trust

OpenAI; San Francisco (CA); On-site; USD 210,000 - 310,000; Full time

Job summary

OpenAI is hiring a Security Software Engineer in San Francisco to design and implement hardware-backed security foundations across our device ecosystem. You will harden the boundary between policy systems and HSMs that protect cryptographic keys, and develop security-critical software near or within the HSM trust boundary.

The role involves designing, coding, debugging, and deploying across hardware and software boundaries, including PKCS#11 interfaces, secure key management, and device identity

Qualifications

• 5+ years experience building secure embedded firmware for constrained environments.
• Deep programming experience in C, C++, or Rust.

Responsibilities

• Design and implement security-critical software and firmware for HSMs, secure elements, trusted execution environments, and hardware roots of trust.
• Build and harden the policy-to-HSM boundary responsible for authorizing certificate issuance and cryptographic signing operations.
• Develop HSM trusted applications, firmware components, host interfaces, device drivers, SDKs, or cryptographic service integrations.
• Implement or extend cryptographic interfaces such as PKCS#11, OpenSSL providers or engines, platform key-storage APIs, or comparable hardware-security interfaces.

Skills

C/C++/Rust

Tools

PKCS#11

OpenSSL

KMIP

Job description

OpenAI is hiring a Security Software Engineer in San Francisco to design and implement hardware-backed security foundations across our device ecosystem. You will harden the boundary between policy systems and HSMs that protect cryptographic keys, and develop security-critical software near or within the HSM trust boundary.

The role involves designing, coding, debugging, and deploying across hardware and software boundaries, including PKCS#11 interfaces, secure key management, and device identity