Lead Principal Security Engineer

Oracle; United States; On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) savings plan with company match

Paid time off and paid parental leave

Employee Stock Purchase Plan

Job summary

Oracle seeks a Consulting Hardware Security Engineer to enhance its cloud infrastructure's security. The role involves defining security requirements, conducting assessments, and ensuring compliance with security standards.

Ideal candidates will have a bachelor’s degree, over 10 years of hardware security experience, knowledge of programming languages, and the ability to assess risk. The position offers comprehensive benefits and opportunities for growth within the organization.

Qualifications

• 10+ years of experience in hardware security architecture, engineering, validation, or planning.
• Demonstrated competency in hardware/firmware focusing on security.
• Extensive research or experience with multiple classes of security bugs.

Responsibilities

• Define security requirements for hardware that align with OCI’s security posture.
• Conduct hands-on security assessments of complex compute systems.
• Identify opportunities for security and process improvements.

Skills

Hardware Security Architecture

Computer Architecture

Reverse Engineering

Programming Languages

Education

Bachelor's degree in Electrical Engineering, Computer Science, or related field

Tools

Reversing Tools

Common Programming Languages (C, C++, Java, Python, Ruby, Go, Rust)

Job description

Job Description

The Oracle Cloud Infrastructure (OCI) team offers the opportunity to build and operate a suite of massively scaled integrated cloud services in a broadly distributed, multi‑tenant cloud environment. OCI is committed to delivering the best cloud products to meet the needs of customers tackling some of the world’s biggest challenges.

As a Consulting Hardware Security Engineer, you will ensure the compute hardware used in OCI meets the required security bar and complies with our security posture. You will define security requirements for hardware, work closely with Oracle, third‑party vendors, and standards organizations to influence the next generation of hardware platform security, and partner with OCI operations and engineering teams to continually improve operational security throughout the cloud infrastructure.

Responsibilities

• Define security requirements for hardware that align with OCI’s security posture and business needs.
• Provide independent design consulting for complex compute systems, balancing business objectives and security risks.
• Drive the implementation of required features, including provisioning, reuse, and decommissioning procedures in line with security posture.
• Conduct hands‑on security assessments of complex compute systems to verify they meet requirements.
• Perform adversarial assessments to ensure systems cannot be compromised.
• Break down complex systems for analysis, assign parts to team members, synthesize inputs, and produce a holistic assessment contextualized to cloud environments.
• Understand business objectives, assess risk through findings and threat models, and identify proper risk‑mitigation controls.
• Collaborate across teams to ensure requirements, findings, and recommendations are implemented inline with expected outcomes.
• Communicate risks and mitigation options to senior leadership, balancing security, technology, and business goals.
• Identify opportunities for security and process improvements and drive them across the organization.
• Advance the industry’s security knowledge through individual research contributions.
• Stay informed of developments and trends in your area of subject matter expertise and educate the business and security organization accordingly.
• Mentor junior engineers.

Minimum Qualifications

• Bachelor’s degree in Electrical Engineering, Computer Science, or related field, or equivalent experience.
• 10+ years of experience in hardware security architecture, engineering, validation, or planning.
• Demonstrated competency in hardware/firmware with a focus on security.
• Competency with computer architecture.
• Subject‑matter expertise in at least two of the following areas:
  • Root of Trust (TCG SRTM, DRTM)
  • x86 (Intel, AMD), ARM server platform architecture, UEFI
  • GPU platforms, rack‑scale systems, clustering
  • Baseboard Management Controllers
  • SmartNICs (DPUs)
  • Storage devices
• Knowledge of security concepts and standards such as Attestation (e.g., SPDM), cryptography, Secureboot, DICE, etc.
• Proficiency with common programming languages (C, C++, Java, Python, Ruby, Go, Rust).
• Ability to read and review complex hardware system/platform‑level schematics for security concerns.
• Experience with reversing tools and the ability to reverse engineer.
• Extensive research or experience with multiple classes of security bugs.
• Specification and/or design of hardware security features.

Preferred Qualifications

• Ability to read and understand x86 and/or ARM assembly language.
• Knowledge of vendor‑specific TEE technologies such as Intel SGX.
• Familiarity with common embedded communications interfaces (SPI, I2C, RS232‑style serial).
• Knowledge of host and network virtualization technologies and how to use them securely.
• Knowledge of enterprise and/or datacenter networking architecture.
• Experience operating in a large‑scale DevOps or CI/CD environment.
• Ability to write clear and concise product security requirements.
• Ability to assess risk from findings and threat models, and identify proper mitigation controls.
• Ability to succeed individually or collaboratively, working internally or with external organizations.
• Significant experience working effectively in a large, distributed company.
• Excellent organizational, verbal, and written communication skills.
• Experience conducting training, thought leadership, conference talks, or publications.

Benefits

• Medical, dental, and vision insurance.
• Short‑term and long‑term disability.
• Life insurance and AD&D.
• Supplemental life insurance (employee/spouse/child).
• Health care and dependent care flexible spending accounts.
• Pre‑tax commuter and parking benefits.
• 401(k) savings and investment plan with company match.
• Paid time off, paid holidays, paid sick leave, and paid parental leave.
• Adoption assistance.
• Employee Stock Purchase Plan.
• Financial planning and group legal services.
• Voluntary benefits including auto, homeowner, and pet insurance.

Equal Employment Opportunity

Oracle is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability, and protected veteran status, or any other characteristic protected by law. Oracle will consider qualified applicants with arrest and conviction records pursuant to applicable law.