Junior Linux and Embedded Systems Security Engineer (Autonomous Vehicle)

About Ocean Aero

Ocean Aero is an award-winning US company that has created the world's first and only environmentally powered Autonomous Underwater and Surface Vehicle (AUSV). Ocean Aero's autonomous marine robot, the Triton, operates exclusively on wind and solar energy and performs long endurance missions on the ocean surface with the ability to dive below the waves for underwater operations. The Triton uses a complex array of custom-built sensors, marinized electronics and software systems to operate, sense and communicate in the environment.

Ocean Aero has a collaborative culture with plenty of opportunities for growth and ownership, and comprehensive benefits.

Role Description

The Junior Linux and Embedded Systems Security Engineer will implement security fixes and hardening across Triton vehicles, Linux servers, cloud workloads, and internal engineering infrastructure. This role is suited to an engineer with practical Linux skills who wants to develop deeper expertise in security operations and embedded systems.

This person will be Ocean Aero's sole dedicated security engineer and will report to engineering leadership. They will own defined remediation tasks from investigation through verified deployment, with closer engineering review for unfamiliar systems, incident decisions, and architecture changes. The existing team will provide onboarding and knowledge of prior security work as the engineer grows into broader security ownership.

This position is dedicated to security and excludes routine IT administration and help desk work. Incident response work takes place during working hours; there is no routine on-call requirement.

This role will report to the Chief Technology Officer.

Role Responsibilities

• Build and maintain an inventory of assets and software versions; run vulnerability assessments and investigate findings against actual system configurations
• Implement, test, deploy, and verify security patches and configuration changes under engineering oversight.
• Write and maintain Ansible playbooks and scripts to automate hardening, patching, and configuration checks
• Configure and compile Linux kernels, apply patches, and troubleshoot build or boot issues with engineering guidance for unfamiliar targets
• Learn the Triton build and release process, including Yocto and BitBake, and contribute security fixes to embedded Linux images
• Perform internal technical assessments using applicable DISA Security Technical Implementation Guides (STIGs); record findings, remediation steps, and evidence of completed changes
• Investigate security alerts and incidents during working hours, coordinate containment and recovery with engineering, and document follow-up actions
• Help develop incident response procedures and run an exercise with engineering, progressing toward independent response leadership as proficiency grows
• Assess vehicle access controls, exposed services, update mechanisms, and network boundaries; contribute to a prioritized vehicle security improvement plan
• Test fixes for functional regressions and recovery behavior, maintain clear technical documentation, and report blockers and unresolved risks
• Priorities for the first 90 days are an asset and vulnerability baseline, a boat security assessment and improvement plan with engineering, and documented incident response procedures tested in an exercise

Role Requirements

• Typically one to three years of relevant Linux, systems engineering, or security experience. Substantial internships, open-source work, and hands-on projects may demonstrate equivalent capability
• Practical Linux command-line and troubleshooting skills, including users and permissions, SSH, services, logs, package management, and basic firewall configuration
• Demonstrated ability to configure and compile a Linux kernel, apply a patch, and boot and verify the result in a lab, virtual machine, or supported target. Production embedded experience is not required
• Ability to write and troubleshoot basic Ansible playbooks, use Git, and automate tasks with shell scripts or Python
• Understanding of vulnerabilities, patching, least privilege, and secure configuration; ability to read an advisory, investigate applicability, and verify a fix
• Working understanding of TCP/IP, ports, DNS, routing, TLS, and firewalls, with the ability to troubleshoot basic connectivity issues
• Foundational familiarity with DISA STIGs and the ability to follow a technical hardening requirement, test the change, and document the result
• A methodical approach to testing and troubleshooting, clear written communication, and the judgment to seek review before making unfamiliar or high-impact changes
• Relevant degree or equivalent practical experience. A portfolio of working systems, automation, or security projects is welcome
• US Citizenship required
• Maintain a valid driver license and personal vehicle insurance
• Ability to obtain and maintain a DoD Security Clearance
• Possess a valid Transportation Worker Identity Credential (TWIC) or successfully pass the requirements to obtain one
• Successfully pass drug test, background check, and motor vehicle screening

Role Preferences

• Yocto, BitBake, cross-compilation, ARM Linux, or embedded systems experience.
• Exposure to vulnerability scanners, log analysis, incident response exercises, or Linux hardening projects.
• Docker, cloud services such as AWS, virtualization, or CI/CD tools such as Jenkins.
• Interest or experience in secure boot, signed updates, device identity, certificate management, encryption, and embedded key storage.
• Networking projects involving VPNs, segmentation, wireless links, or intermittently connected systems.
• Experience with robotics, maritime systems, C or C++, or AI-assisted engineering tools whose results you can independently verify.

Professional Development

With demonstrated proficiency, this role will take increasing ownership of security prioritization, incident response leadership, and the full vehicle security roadmap. Development areas include secure boot, signed updates, encryption and key management, payload isolation, and recovery.