HSM & Hardware-Backed Security Engineer

Triwill Group; San Francisco, Northern (CA, KY); Hybrid; USD 180,000 - 240,000; Full time

Job summary

OpenAI is seeking a Security Software Engineer to design and implement hardware-backed security foundations used across our device ecosystem. You will build and harden the policy-to-HSM boundary, develop HSM trusted applications, and integrate cryptographic services across embedded systems.

You will work with hardware, firmware, and backend teams to enable secure-by-default capabilities, conduct threat modeling, and ensure verifiability and auditable changes across trusted execution

Qualifications

• 5+ years experience building secure embedded firmware for constrained environments.
• Deep programming experience in C, C++, or Rust.
• Experience working with HSMs, secure elements, TEEs or hardware roots of trust.
• Strong knowledge of applied cryptography, digital signatures, key management and cryptographic protocols.

Responsibilities

• Design and implement security-critical software and firmware for HSMs, secure elements, TEEs, and hardware roots of trust.
• Build and harden the policy-to-HSM boundary for certificate issuance and cryptographic signing operations.
• Develop HSM trusted applications, firmware components, host interfaces, device drivers, SDKs, or cryptographic service integrations.
• Implement cryptographic interfaces such as PKCS#11, OpenSSL providers or engines, and platform key-storage APIs.
• Build firmware and software that enforce key generation, provisioning, usage, rotation and destruction policies.
• Design HSM-backed certificate authority, code-signing, key-management and device-identity systems.

Skills

C

C++

Rust

Tools

PKCS#11

OpenSSL

Job description

OpenAI is seeking a Security Software Engineer to design and implement hardware-backed security foundations used across our device ecosystem. You will build and harden the policy-to-HSM boundary, develop HSM trusted applications, and integrate cryptographic services across embedded systems.

You will work with hardware, firmware, and backend teams to enable secure-by-default capabilities, conduct threat modeling, and ensure verifiability and auditable changes across trusted execution