Senior Platform Engineer - Embedded Linux & Security

Senior Platform Engineer, Embedded Linux & Security

About the role

This role secures embedded Linux devices and the infrastructure behind them, from boot and provisioning through release, deployment, and cloud services. You'll join a small engineering team as a senior individual contributor, working across device security, DevOps, and backend development.

What you'll do

• Work with and improve secure device provisioning and hardware-backed security, including fusing, signing, device identity, secure boot, attestation, and disk encryption.

• Help define and harden software release processes from source to device.

• Help design device authentication and authorization services.

• Harden device images and container runtimes, including mandatory access control such as AppArmor or SELinux.

• Run services with least privilege: systemd sandboxing, non-root accounts, and correct file ownership and permissions.

• Set SSH and firewall policy, and close debug paths such as UART, JTAG, and USB recovery.

• Secure web services on devices and in the cloud with TLS and mTLS, reverse proxies, and least-privilege service accounts.

• Threat model the platform, help scope pentests, and track vulnerabilities.

• Plan security for partner engagements and third-party integrations: define requirements, review interfaces and data flows, and set access boundaries.

• Help shape fleet management and over-the-air update approaches, from device enrollment through deployment.

• Build cloud pipelines for device data and identity, with least-privilege access scoped to each device.

• Contribute to arm64 build and image pipelines, including cross-compilation, QEMU-based builds and tests, multi-arch containers, and rootfs customization.

• Write and maintain backend code for device and infrastructure tooling.

What you bring

• 6+ years of experience across Linux systems, security, and infrastructure engineering.

• Strong working knowledge of hardware-backed security: secure boot chains, fused keys, TPMs and firmware TPMs, TEEs, attestation, and sealed storage.

• Hands-on experience hardening Linux devices, containers, and services, with fluency in permissions, capabilities, and systemd.

• Current knowledge of how to secure edge and IoT devices, such as A/B partitions, read-only root filesystems, and verified boot.

• Confidence building and securing cloud infrastructure and CI/CD pipelines.

• Solid coding skills for tooling and backend services, and the ability to review code for security issues.

• Experience threat modeling systems and working with penetration testers or red teams.

• A bias toward action: delivering on priorities with urgency, and proactively finding, raising, and fixing issues with the team along the way.

Nice to have

• Hands-on implementation of secure boot, key fusing, or attestation on embedded hardware

• Hands-on implementation of secure OTA updates, including fleet update tools such as Mender

• ML model security on edge devices: current risks and mitigations

• Embedded pentesting or red team work: UART and JTAG access, firmware extraction, rollback and recovery-mode attacks

• Cloud security depth: serverless, IAM policy design, key management, device identity

• Infrastructure as code with tools such as Terraform or Ansible

• C++, Python

• Experience in defense, export-controlled, or CMMC-regulated environments

• Experience in a small, fast-paced startup environment

• Familiarity with corporate security and IT infrastructure