Embedded Systems Security Engineer

Embedded Systems Security Engineer

6 Month Contract (Possible extension

Location: Fully Onsite - 5 Days Onsite (Client located in Foster City, CA

Work Shift : Monday through Friday (8:00AM – 5:00PM PST

*Must be able to work on W-2 basis

*Must be local to the Foster City, CA area

One of the country's largest technology teams is searching Embedded Systems Security Engineer to develop and implement security solutions that harden our next-generation embedded Linux platform. You will bridge the gap between low-level hardware security, kernel hardening, and secure user-space application containment. This role encompasses designing cryptographic defense mechanisms, automating security pipelines in CI/CD, and collaborating with manufacturing teams to securely and reliably provision devices at scale. If you’re energized by solving technical problems, and delivering rock-solid releases, this is an incredible opportunity to make a difference! This exciting opportunity to work as a Hardware & Software Integration Engineer begins as a 6-month W2 contract and the potential for extension or conversion to a permanent role. Comprehensive benefits are also available.

We are seeking an Embedded Systems Security Engineer to develop and implement security solutions that harden our next-generation embedded Linux platform. You will bridge the gap between low-level hardware security, kernel hardening, and secure user-space application containment. This role encompasses designing cryptographic defense mechanisms, automating security pipelines in CI/CD, and collaborating with manufacturing teams to securely and reliably provision devices at scale.

Platform Hardening & Architecture

• Design and implement the Hardware Root of Trust and Secure Boot architecture spanning from the first-stage bootloader through the Linux kernel.

Storage & Integrity Management

• Implement dm-verity for cryptographically verified, read-only root filesystems; ensure secure data encryption at rest.

Trusted Execution Environments

• Develop, integrate, and maintain a TEE (e.g., OP-TEE); author Secure/Trusted Applications (TAs).

Application Sandboxing

• Enforce strict user-space isolation and sandboxing using SELinux, AppArmor, cgroups, namespaces, and seccomp filters to protect core systems.

DevSecOps Automation

• Build automated cryptographic signing pipelines within CI/CD (e.g., GitLab CI, GitHub Actions) for secure signing of bootloaders, kernels, and OTA payloads using HSMs or secure key vaults.

Production Provisioning Support

• Collaborate with manufacturing on writing robust scripts and tools for secure burning of hardware fuses (eFuses/OTP memory) and develop end-of-line (EOL) test software to validate security features.

System Resilience

• Architect multi-slot boot recovery layouts (e.g., A/B partitioning) to guarantee fail-safe operation in the event of failed OTA updates or corrupted boots.

Skill Requirements

• 6+ years in Embedded Linux development, board bring-up, and BSP customization.
• 3+ years hands-on experience deploying device-level security features into production hardware.
• Technical Skills :
• Deep expertise in bootloader configurations (e.g., U-Boot Verified Boot, Barebox) and Linux kernel storage/security subsystems (dm-crypt, dm-verity).
• Strong understanding of modern processor security architectures, notably ARM TrustZone (ARMv7-A / ARMv8-A, Exception Levels EL1–EL3).
• Proven track record with SELinux/AppArmor policy implementation, and Linux containment tools (cgroups, namespaces).
• Proficiency with embedded Linux build automation (Yocto Project, BitBake, or Buildroot).
• Advanced programming in C; strong scripting in Python or Bash.

Preferred Qualifications

• Strong foundational knowledge of symmetric/asymmetric cryptography, hashing algorithms (SHA-256/384), PKI, and physical Hardware Security Modules (HSMs).
• Experience collaborating with Contract Manufacturers or factory lines for secure key-injection and fuse-burning protocols.
• Experience with embedded container runtimes (e.g., LXC, crun) or lightweight sandboxing frameworks for constrained devices.
• Experience designing secure versioning and hardware-enforced anti-rollback update strategies.

Education

Bachelor’s degree in Computer Science, Computer Engineering, Electrical Engineering, or a related technical discipline (or equivalent practical experience).

You will receive the following benefits:

Medical Insurance & Health Savings Account (HSA)

401(k)

Paid Sick Time Leave

Pre-tax Commuter Benefit

Motion Recruitment provides IT Staffing Solutions (Contract, Contract-to-Hire, and Direct Hire) in major North American markets. Our unique expertise in today’s highest-demand tech skill sets, paired with our deep networks and knowledge of our local technology markets, results in an exemplary track record with candidates and clients.