Staff Embedded Systems Security Engineer

Responsibilities

• Own security architecture, threat modeling, and defensive controls for spacecraft platforms, including flight computers, firmware, FPGA gateware, cryptographic implementations, and secure boot.
• Build security platforms, tooling, and foundational services for secure-by-default flight software, firmware, and hardware configuration.
• Design and operate PKI for device authentication, firmware signing, secure boot, certificate lifecycle management, and secure key storage on resource-constrained spacecraft.
• Architect cryptographic and security implementations meeting FIPS 140-3, CNSA 2.0, and CCSDS Space Data Link Security requirements, including post-quantum cryptography migration.
• Harden flight software build and deployment tooling and protect the supply-chain integrity of build outputs, dependencies, and third-party components.
• Lead security assessments and penetration testing for spacecraft, RF systems, and test environments.
• Drive secure design practices across flight software, hardware, and test engineering teams and mentor engineers through technical leadership.
• Use AI to accelerate development, analyze security data, and address embedded systems security challenges.

Requirements

• Active security clearance or the ability to obtain and maintain one.
• Deep hands-on expertise in embedded, hardware, firmware, and hardware security, including attack surfaces, side-channel attacks, fault injection, firmware security, secure boot, and HSMs.
• Strong C and C++ development skills, engineering fundamentals, debugging production systems, and low-level experience with assembly and firmware.
• Proven experience building production security platforms, tooling, and foundational services for hardware and embedded engineering teams.
• Expert PKI knowledge for embedded and resource-constrained systems, including device authentication, firmware-signing certificate chains, secure-boot PKI hierarchies, certificate provisioning and rotation, secure key storage, and HSM integration.
• Expert applied cryptography experience with FIPS 140-3, familiarity with CNSA 2.0 and CCSDS SDLS, post-quantum cryptography migration, and NIST 800-series publications.
• Experience applying hardware and firmware security-testing methodologies and building automated testing tooling and frameworks at scale.
• Principal-level impact in setting security strategy, prioritizing risks, leading hardening initiatives, mentoring engineers, and influencing teams without direct authority.
• Preferred: hands-on experience with formal FIPS validation through CMVP.
• Preferred: real-time or safety-critical embedded systems experience and background in aerospace, defense, avionics, medical devices, or industrial control systems.
• Preferred: hardware reverse engineering, firmware analysis, FPGA/VHDL security, RF/radio security, HIL/SIL infrastructure, embedded Linux, supply-chain security, and hardened embedded build pipelines.
• Preferred: evidence of practical security impact such as published CVEs, research, publications, conference talks, open-source contributions, or relevant projects.

Benefits

• Base salary of $200,000-$305,000.
• Equity and health, dental, vision, HRA/HSA, PTO, paid holidays, 401(k), and parental leave benefits.
• Hybrid work environment with some on-site work required.
• Successful candidates must be located near Denver or Colorado Springs.
• The position requires the ability to obtain and maintain a security clearance.
• The position is subject to U.S. Government space technology export regulations, including ITAR eligibility requirements.