Secure Embedded Systems Engineer: Root of Trust & OTA

Tap Growth ai; Foster City (CA); On-site; USD 140,000 - 190,000; Full time

Job summary

Tap Growth ai is seeking an Embedded Systems Security Engineer to harden our next-gen embedded Linux platform. You will bridge hardware security, kernel hardening and secure user-space containment to design cryptographic defenses and automate security pipelines in CI/CD.

You will collaborate with manufacturing to provision devices securely at scale, implement secure boot, dm-verity, OP-TEE TEEs, SELinux/AppArmor and multi-slot boot recovery to ensure OTA resilience and production reliability.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, Electrical Engineering, or related discipline (or equivalent practical experience).
• 6+ years Embedded Linux development, board bring-up, and BSP customization.
• 3+ years deploying device-level security features into production hardware.
• Expert knowledge of bootloader configurations (U-Boot/Barebox) and customizing Linux kernel storage/security subsystems (dm-crypt, dm-verity).
• Deep understanding of ARM TrustZone (ARMv7-A/ARMv8-A, EL1-EL3).
• Experience with SELinux/AppArmor policies and Linux containment tools (cgroups, namespaces).
• Proficiency with Yocto Project or Buildroot for automated builds.
• Advanced proficiency in C and scripting in Python or Bash.

Responsibilities

• Design and implement Hardware Root of Trust and Secure Boot architecture from first-stage bootloader through the Linux kernel.
• Implement dm-verity and encryption at rest for verified read-only root and data protection.
• Develop, integrate, and maintain a TEE (OP-TEE) and Secure/Trusted Applications.
• Enforce sandboxing with SELinux/AppArmor, cgroups, namespaces, and seccomp filters.
• Build automated cryptographic signing pipelines in CI/CD (GitLab CI, GitHub Actions) using HSMs or secure vaults.
• Collaborate with manufacturing to write scripts for burning eFuses/OTP and end-of-line tests for security validation.
• Architect multi-slot boot recovery layouts (A/B partitions) to ensure OTA resilience.

Skills

Embedded Linux

Board bring-up

BSP customization

Bootloaders

Linux security

SELinux/AppArmor

Yocto/Buildroot

C programming

Python/Bash

Education

Bachelor's degree

Tools

OP-TEE

dm-verity

dm-crypt

Yocto Project

Buildroot

LXC/crun

Job description

Tap Growth ai is seeking an Embedded Systems Security Engineer to harden our next-gen embedded Linux platform. You will bridge hardware security, kernel hardening and secure user-space containment to design cryptographic defenses and automate security pipelines in CI/CD.

You will collaborate with manufacturing to provision devices securely at scale, implement secure boot, dm-verity, OP-TEE TEEs, SELinux/AppArmor and multi-slot boot recovery to ensure OTA resilience and production reliability.