Lead SoC Security Software Engineer

Anodize; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Anodize is seeking a Lead SoC Security Software Engineer to own the software foundation for our hardware security. You will operate at the intersection of firmware, silicon, and cryptography to secure Root of Trust, media pathways and secret storage.

You will bridge hardware primitives with high-level software, ensuring tamper-proof and private platform design from development through production.

Qualifications

• 6+ years in SoC/Embedded Security.
• Hands-on experience with ARM v8/v9, TrustZone, and firmware integration (TF-A).
• Practical PKI and hardware-based secret storage in production environments.

Responsibilities

• Root of Trust & Secure Boot: architect and implement chain of trust from power-on, including TF-A and secure boot sequences.
• Secure Subsystem & Cryptography: build firmware for Secure Subsystem/TEE to manage keys and crypto ops in isolation.
• Encrypted Media Pipelines: design end-to-end encrypted pathways for media, integrating DRM/HDCP with memory isolation.
• Hardware/Software Co-Design: define security requirements for IP blocks (OTP/eFuses, PUF, crypto accelerators).
• Vulnerability Hardening: model threats and implement defenses against physical and logical attacks, including side-channel analysis.

Skills

SoC security

ARM TrustZone

Rust or C

TF-A / OP-TEE

Cryptography & Key Mgmt

Job description

Summary

We're a well-funded, stealth startup building a new end-to-end personal computing platform based on our own custom silicon. As our Lead SoC Security Software Engineer, you will own the software foundation for our hardware security. You will operate at the intersection of firmware, silicon, and cryptography, architecting the systems that keep our platform private and tamper-proof. You will bridge the gap between hardware primitives and high-level software, ensuring our Root of Trust, secure media pathways, and secrets storage are secure by design.

Summary

We're a well-funded, stealth startup building a new end-to-end personal computing platform based on our own custom silicon. As our Lead SoC Security Software Engineer, you will own the software foundation for our hardware security. You will operate at the intersection of firmware, silicon, and cryptography, architecting the systems that keep our platform private and tamper-proof. You will bridge the gap between hardware primitives and high-level software, ensuring our Root of Trust, secure media pathways, and secrets storage are secure by design.

Responsibilities

• Root of Trust & Secure Boot: Architect and implement the entire chain of trust from power-on, including TF-A, secure boot sequences, and hardware-backed verification.
• Secure Subsystem & Cryptography: Build the firmware for our Secure Subsystem / TEE to manage sensitive keys, execute cryptographic operations in isolation, and handle secure provisioning.
• Encrypted Media Pipelines: Design and enforce end-to-end encrypted pathways for high-value media, integrating DRM and HDCP frameworks while maintaining memory isolation from the application processor.
• Hardware/Software Co-Design: Work directly with the silicon and hardware teams to define security requirements for IP blocks, including OTP/eFuses, PUF, and crypto accelerators.
• Vulnerability Hardening: Proactively model threats and implement defenses against physical and logical attacks, including side-channel analysis and fault injection, to ensure our product stays resilient.

Minimum Requirements

• 6+ years in SoC/Embedded Security: Deep expertise in silicon-level security, firmware engineering, and building secure platforms.
• ARM Architecture Experience: Hands-on experience with ARM v8/v9, ARM TrustZone, and low-level firmware integration (TF-A, OP-TEE).
• Cryptography & Key Management: Practical experience implementing PKI, symmetric/asymmetric schemes, and hardware-based secret storage in production environments.
• Low-Level Software Fluency: Expert-level C or Rust programming for constrained environments; comfortable reading datasheets and debugging assembly.

Preferred Qualifications

• Experience implementing secure display/video paths, DRM, or memory isolation primitives.
• Experience hardening firmware against physical side-channel and fault-injection attacks.
• Background in Linux kernel security (dm-verity, module signing, hypervisors) or TEE development.
• Experience delivering firmware through the full silicon lifecycle, from tape-out and secure manufacturing to field deployment.
• Familiarity with Linux kernel fundamentals, KVM, eBPF, and security modules.