Embedded Systems Security Engineer

DeWinter Group; Foster City (CA); On-site; USD 120,000 - 160,000; Full time

Job summary

DeWinter Group is seeking an Embedded Systems Security Engineer in Foster City, CA. You will lead the design of security architectures for innovative embedded Linux devices, ensuring they are robust and secure.

Ideal candidates will have over 6 years of experience in embedded systems development, a strong grasp of security features, and proficiency in programming. The role requires onsite presence, fostering collaboration with engineering and manufacturing teams.

Qualifications

• 6+ years of experience in Embedded Linux development.
• 3+ years deploying device-level security features in production.
• Strong understanding of Linux kernel security subsystems.

Responsibilities

• Design and implement Hardware Root of Trust architectures.
• Develop cryptographically verified read-only filesystems.
• Automate cryptographic signing pipelines within CI/CD workflows.

Skills

Embedded Linux development

Bash scripting

C programming

System security expertise

Device-level security features

Education

Bachelor’s degree in Computer Science or related field

Tools

SELinux

U-Boot

Yocto Project

Job description

Join Our Team as an Embedded Systems Security Engineer!

Are you passionate about pioneering security solutions for cutting-edge embedded Linux platforms? We are seeking an innovative and experienced Embedded Systems Security Engineer to lead the design and implementation of robust security architectures for next-generation devices. In this pivotal role, you'll bridge the gap between hardware security, kernel hardening, and secure user-space application containment, ensuring our products are resilient, scalable, and secure from the ground up. If you're ready to make a tangible impact on device security at scale, we want to hear from you.

What You Will Do:

• Design and implement Hardware Root of Trust and Secure Boot architectures from the bootloader to the Linux kernel.
• Develop cryptographically verified read-only filesystems using dm-verity and implement data encryption at rest.
• Build and maintain Trusted Execution Environments (TEEs) like OP-TEE, and develop secure applications.
• Enforce strict user-space isolation using SELinux, AppArmor, cgroups, namespaces, and seccomp filters.
• Automate cryptographic signing pipelines within CI/CD workflows, utilizing HSMs or secure key vaults.
• Collaborate with manufacturing to develop secure device provisioning scripts and validation tools.
• Architect multi-slot boot recovery systems to enhance system resilience against OTA failures and corruption.

Required Skills:

• Bachelor’s degree in Computer Science, Electrical Engineering, or related field (or equivalent experience).
• 6+ years of experience in Embedded Linux development, board bring-up, and BSP customization.
• 3+ years deploying device-level security features into production hardware.
• Expertise with bootloader configurations (U-Boot, Barebox) and Linux kernel security subsystems (dm-crypt, dm-verity).
• Deep understanding of ARM TrustZone architecture (ARMv7-A / ARMv8-A).
• Proven experience with SELinux/AppArmor policies and Linux containment tools (cgroups, namespaces).
• Proficiency with embedded build systems like Yocto Project or Buildroot.
• Strong programming skills in C, with scripting expertise in Python or Bash.

Nice to Have Skills:

• Solid foundation in cryptography, including symmetric/asymmetric algorithms, SHA-256/384, and PKI.
• Experience working with Contract Manufacturers or factory lines on secure key injection and fuse-burning protocols.
• Knowledge of embedded container runtimes (LXC, crun) and lightweight sandboxing frameworks.
• Experience designing anti-rollback protection mechanisms for OTA updates.

Preferred Education and Experience:

• Bachelor’s degree in a relevant technical discipline.
• 6+ years of hands‑on experience in embedded Linux security and development environments.
• Prior experience with manufacturing scale deployments and security protocols.

Other Requirements:

• This is an onsite role based in Foster City, CA. Must be willing to work 5 days in the office.
• No relocation is provided; local candidates preferred.
• Ability to work collaboratively with manufacturing and engineering teams.
• Must be legally authorized to work in the United States.

DeWinter Group and Maris Consulting are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. We post pay scales which are based on our client pay ranges. DeWinter, Maris, and our clients have the right to modify the requirements of the role which can impact the pay ranges posted.