Software Security Architect

Responsibilities

• Define the operating system’s security architecture, trust boundaries, privilege model, and sensitive-data protections.
• Integrate hardware-backed security capabilities, roots of trust, secure elements, trusted execution environments, and processor security features into the operating system.
• Design platform defenses including secure boot, code signing, attestation, secure updates, key protection, and device recovery.
• Establish isolation and access controls across the kernel, applications, system services, and AI workloads.
• Define guardrails for AI applications and agents accessing information, sensors, tools, retained context, and user-authorized actions.
• Lead threat modeling and architecture reviews and translate emerging threats into enforceable requirements.
• Prototype solutions, review security-critical systems code, and guide engineering teams through technical and product tradeoffs.

Requirements

• Deep experience designing or securing operating systems, kernels, embedded platforms, hypervisors, or other privileged systems software.
• Strong understanding of operating system internals, including memory protection, process isolation, executable loading, device drivers, and privilege boundaries.
• Experience building security architectures spanning hardware, firmware, operating systems, applications, and cloud services.
• Practical expertise in secure boot, code signing, device identity, attestation, trusted execution, and hardware-backed key protection.
• Ability to write or review systems code in C, C++, Rust, or comparable languages, with knowledge of secure development and exploit mitigation.
• Experience building threat models, influencing cross-functional engineering teams, and communicating security tradeoffs clearly.
• Helpful experience includes consumer operating systems, mobile platforms, connected devices, kernel hardening, memory-safety mitigations, virtualization-based security, secure enclave integration, AI-agent security architecture, device provisioning, manufacturing security, secure recovery, or hardware lifecycle security.