Embedded Systems Security Engineer

Tap Growth ai; Foster City (CA); On-site; USD 140,000 - 190,000; Full time

Job summary

Tap Growth ai is seeking an Embedded Systems Security Engineer to harden our next-gen embedded Linux platform. You will bridge hardware security, kernel hardening and secure user-space containment to design cryptographic defenses and automate security pipelines in CI/CD.

You will collaborate with manufacturing to provision devices securely at scale, implement secure boot, dm-verity, OP-TEE TEEs, SELinux/AppArmor and multi-slot boot recovery to ensure OTA resilience and production reliability.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, Electrical Engineering, or related discipline (or equivalent practical experience).
• 6+ years Embedded Linux development, board bring-up, and BSP customization.
• 3+ years deploying device-level security features into production hardware.
• Expert knowledge of bootloader configurations (U-Boot/Barebox) and customizing Linux kernel storage/security subsystems (dm-crypt, dm-verity).
• Deep understanding of ARM TrustZone (ARMv7-A/ARMv8-A, EL1-EL3).
• Experience with SELinux/AppArmor policies and Linux containment tools (cgroups, namespaces).
• Proficiency with Yocto Project or Buildroot for automated builds.
• Advanced proficiency in C and scripting in Python or Bash.

Responsibilities

• Design and implement Hardware Root of Trust and Secure Boot architecture from first-stage bootloader through the Linux kernel.
• Implement dm-verity and encryption at rest for verified read-only root and data protection.
• Develop, integrate, and maintain a TEE (OP-TEE) and Secure/Trusted Applications.
• Enforce sandboxing with SELinux/AppArmor, cgroups, namespaces, and seccomp filters.
• Build automated cryptographic signing pipelines in CI/CD (GitLab CI, GitHub Actions) using HSMs or secure vaults.
• Collaborate with manufacturing to write scripts for burning eFuses/OTP and end-of-line tests for security validation.
• Architect multi-slot boot recovery layouts (A/B partitions) to ensure OTA resilience.

Skills

Embedded Linux

Board bring-up

BSP customization

Bootloaders

Linux security

SELinux/AppArmor

Yocto/Buildroot

C programming

Python/Bash

Education

Bachelor's degree

Tools

OP-TEE

dm-verity

dm-crypt

Yocto Project

Buildroot

LXC/crun

Job description

We are looking for an Embedded Systems Security Engineer to implement a security solution to harden our next-generation embedded Linux platform. In this role, you will bridge the gap between low-level hardware security, kernel hardening, and secure user-space application containment. You will not only design cryptographic defense mechanisms but will also automate security pipelines in CI/CD and partner directly with manufacturing teams to ensure devices are provisioned securely and reliably at scale without production risks

• Platform Hardening & Architecture: Design and implement the Hardware Root of Trust and Secure Boot architecture from the first-stage bootloader through the Linux kernel.
• Storage & Integrity Management: Implement dm-verity for cryptographically verified read-only root filesystems and secure data encryption at rest.
• Trusted Execution Environments: Develop, integrate, and maintain a TEE (e.g., OP-TEE) and author Secure/Trusted Applications (TAs).
• Application Sandboxing: Enforce strict user-space isolation and sandboxing strategies using SELinux, AppArmor, cgroups, namespaces, and seccomp filters to protect core systems from untrusted applications.
• DevSecOps Automation: Build automated cryptographic signing pipelines within CI/CD infrastructure (e.g., GitLab CI, GitHub Actions) to securely sign bootloaders, kernels, and OTA payloads using HSMs or secure key vaults.
• Production Provisioning Support: Collaborate with manufacturing teams to write robust scripts and tools for burning permanent hardware configuration fuses (eFuses / OTP memory) securely, designing end-of-line (EOL) test software to validate security features before shipping.
• System Resilience: Architect multi-slot boot recovery layouts (e.g., A/B partitioning) to guarantee fail-safe resilience against failed OTA updates or corrupted boots.

Qualifications

• Education: Bachelor's degree in Computer Science, Computer Engineering, Electrical Engineering, or a related technical discipline (or equivalent practical experience).
• Core Experience: 6+ years of professional experience in Embedded Linux development, board bring-up, and Board Support Package (BSP) customization.
• Security Focus: 3+ years of dedicated, hands-on experience deploying device-level security features into physical production hardware.
• Low-Level Systems: Expert knowledge of bootloader configurations (e.g., U-Boot Verified Boot, Barebox) and customizing the Linux kernel storage/security subsystem (dm-crypt,dm-verity).
• Hardware Security Architecture: Deep understanding of modern processor security architectures, specifically ARM TrustZone (ARMv7-A / ARMv8-A, Exception Levels EL1-EL3).
• Sandboxing & Access Controls: Proven track record implementing SELinux/AppArmor policies and utilizing standard Linux containment tools (cgroups, namespaces).
• Build Automation: Proficiency with embedded Linux build automated frameworks like the Yocto Project (BitBake recipe design) or Buildroot.
• Programming: Advanced proficiency in C and strong scripting skills in Python or Bash.

Preferred Qualifications

• Cryptography Expertise: Strong foundational knowledge of symmetric/asymmetric cryptography, hashing algorithms (SHA-256/384), public key infrastructure (PKI), and handling physical Hardware Security Modules (HSMs).
• Manufacturing Scale: Prior experience working with Contract Manufacturers (CMs) or internal factory lines to deploy secure key-injection and fuse-burning protocols.
• Advanced Sandboxing: Experience with embedded container runtimes (e.g., LXC, crun) or lightweight sandboxing frameworks tailored for resource-constrained architectures.
• Anti-Rollback Protection: Experience designing secure versioning and hardware-enforced anti-rollback strategies for OTA updates