Embedded security engineer in automotive firmware

Eagle Wireless; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Flexible hours

Remote work options

Career growth opportunities

Job summary

Eagle Wireless ищет инженера по безопасности встроенных систем с опытом разработки под Linux и знанием Yocto для работы над безопасностью прошивок для автомобильной и IoT продукции. Ваша задача — анализировать CVE, поддерживать SBOM, патчить ядро и интегрировать решения в CI и релизы.

Требуется более 3 лет опыта, глубокие знания C/C++, умение работать с инструментами отладки и совместно работать с заказчиками в условиях гибкого графика. Возможна удаленная работа в рамках США.

Qualifications

• Степень в области Computer Science, Electrical Engineering или смежной области
• 3+ года разработки под встраиваемый Linux
• Опыт работы с Yocto/OpenEmbedded: BitBake, слои, .bbappend/patch workflow
• Опыт патчинга ядра Linux: backport на.vendor kernel
• Сильные знания в области информационной безопасности: CVSS, моделирование угроз
• Умение диагностировать на оборудовании через консоль, gdb и логи
• Грамотная документация и общение с заказчиками
• Плюсом: опыт с платформой Qualcomm: модем/baseband, TrustZone/QTEE
• Знания LTE/5G NAS/RRC, IMS/VoLTE, SIM/UICC

Responsibilities

• Проводить сканирование CVE/OSS для выпуска прошивки
• Поддерживать SBOM для каждого продукта/релиза
• Анализировать достижимость CVE в конфигурации
• Писать оценки рисков и dispositions
• Приоритизировать исправления по severity и exposure
• Внедрять патчи и возвращать их в Yocto сборку
• Интегрировать патчи Qualcomm, TrustZone/QTEE и загрузчик
• Проверять исправления через полное тестирование и регрессию
• Вести историю патчей и влияние на релизы
• Помогать клиентам с опросниками безопасности и сертификациями
• Улучшать CI: сканирование CVE, SBOM и оповещения

Skills

Embedded Linux

C/C++

Yocto/OpenEmbedded

Kernel patching

Security fundamentals

Git/Gerrit

Troubleshooting

Education

Степень в информатике или ЭИ

Tools

QXDM

QCAT

QFIL

Job description

Описание

Eagle Wireless is a connectivity company delivering secure, reliable, and scalable cellular modules and solutions for automotive and IoT applications. With a strong presence in the United States and global R&D teams across North America, Europe, and APAC, Eagle Wireless supports customers worldwide with long-life, compliant, and cyber-secure connectivity products. Focused on trust, supply chain resilience, and regulatory compliance, Eagle Wireless helps OEMs, Tier 1 suppliers, and IoT innovators deploy connected technologies with confidence in an increasingly complex global environment.

Задачи

• Perform scanning and analyze of CVE/OSS for firmware releases
• Maintain an accurate SBOM (software bill of materials) per product/release, covering open-source and proprietary vendor components
• Analyze whether a CVE is actually reachable and exploitable in our configuration
• Write risk assessments and dispositions (affected / not affected / mitigated / fix planned) per product line and release for customers
• Prioritize fixes based on severity, exploitability, and exposure; elevate critical remotely-exploitable issues immediately
• Backport upstream fixes into our Yocto build
• Integrate Qualcomm security patches, TrustZone/QTEE, and bootloader trees; adapt patches that conflict with local modifications
• Verify fixes end-to-end: rebuild affected images, run regression tests, and re-test proof-of-concept exploits where available
• Maintain patch and disposition history per firmware release; feed fixes into release planning and release notes
• Support customer security questionnaires, audits, and regulatory/certification needs (UNECE R155/CSMS, ISO/SAE 21434, carrier and RED/CRA requirements)
• Improve pipeline automation: CVE scanning in CI, SBOM generation, and alerting on new advisories affecting shipped versions

Требования

• Degree in Computer Science, Electrical Engineering, or a related field
• 3+ years embedded Linux development, with strong C (and working C++) skills
• Hands-on Yocto/OpenEmbedded experience: BitBake recipes, layers, .bbappend/patch workflow, devtool
• Linux kernel patching experience: backporting fixes from mainline/LTS to a vendor kernel
• Solid security fundamentals: vulnerability classes, CVSS scoring, threat modeling of embedded attack surfaces
• Good troubleshooting instincts: comfortable with incomplete information, diagnosing on-target with serial console, gdb, and logs
• Proficient with git/gerrit on large multi-repo codebases, cross-compilation, and debugging on embedded targets
• Excellent written communication skills: able to produce clear, precise technical risk assessments for customers and auditors
• Будет плюсом: Qualcomm platform experience: modem/baseband codebase structure (AMSS, Hexagon DSP), TrustZone/QTEE, secure boot chain, EFS/NV configuration
• Cellular protocol knowledge (LTE/5G NAS/RRC, IMS/VoLTE, SIM/UICC)
• Experience with Qualcomm tooling (QXDM/QCAT log analysis, QFIL)
• SELinux policy, secure coding review, fuzzing, or penetration-testing experience
• Familiarity with automotive/regulatory security frameworks: UNECE R155, Cyber Resilience Act, carrier security requirements

Условия

• Competitive salary and performance-based bonuses
• Opportunities for professional growth and development
• Flexible working hours and remote work options