Remote Embedded Security Architect: Secure Boot & TEEs

BairesDev; United States; Remote; MXN 2,037,000 - 3,055,000; Full time

Benefits offered by this job

Remote work

Flexible hours

Remote setup

Competitive compensation

Job summary

BairesDev is seeking an Embedded Security Engineer to architect Secure Boot and a hardware root of trust across the boot chain, from bootloader to kernel, and to harden storage with dm-verity/dm-crypt. You will build a Trusted Execution Environment, enable sandboxing, automate signing in CI/CD, and apply OP-TEE, TrustZone, and Yocto workflows on embedded Linux hardware.

Join a fully remote, flexible team and contribute to foundational security for connected devices while collaborating with

Qualifications

• 5+ years of experience in embedded systems engineering with a security focus.
• Strong expertise in embedded Linux security, including dm-verity, dm-crypt, and ARM TrustZone EL1-EL3.
• Proven experience designing hardware root of trust and Secure Boot from scratch, including U-Boot Verified Boot from bootloader through kernel.
• Experience with embedded Linux board bring-up and BSP customization using Yocto.
• Background with TEE development and trusted application authoring using OP-TEE.
• Strong C skills with Python or Bash scripting.
• Advanced proficiency in English.

Responsibilities

• Architect and implement Secure Boot from bootloader through kernel, building a hardware root of trust from scratch.
• Harden storage using dm-verity and dm-crypt.
• Stand up a Trusted Execution Environment and author trusted applications.
• Enforce user-space sandboxing and access control mechanisms.
• Automate cryptographic signing pipelines in CI/CD against a signing backend.

Skills

Secure Boot

Embedded Linux security

dm-verity

dm-crypt

TrustZone

U-Boot

Yocto

OP-TEE

C programming

Python scripting

English

Tools

Yocto

OP-TEE

U-Boot

Job description

BairesDev is seeking an Embedded Security Engineer to architect Secure Boot and a hardware root of trust across the boot chain, from bootloader to kernel, and to harden storage with dm-verity/dm-crypt. You will build a Trusted Execution Environment, enable sandboxing, automate signing in CI/CD, and apply OP-TEE, TrustZone, and Yocto workflows on embedded Linux hardware.

Join a fully remote, flexible team and contribute to foundational security for connected devices while collaborating with