Software Engineer, HSM Infrastructure Security

Responsibilities

• Design and implement security-critical software and firmware for HSMs, secure elements, trusted execution environments, and hardware roots of trust.
• Build and harden policy-to-HSM boundaries governing certificate issuance and cryptographic signing operations.
• Develop HSM trusted applications, firmware components, host interfaces, device drivers, SDKs, and cryptographic service integrations.
• Implement interfaces and services involving PKCS#11, OpenSSL providers or engines, platform key-storage APIs, and related hardware-security interfaces.
• Build systems enforcing key generation, provisioning, usage, rotation, recovery, and destruction policies.
• Design HSM-backed certificate authority, code-signing, key-management, device-identity, attestation, secure-boot, and provisioning systems.
• Develop end-to-end cryptographic protocols spanning devices, secure hardware, policy services, and backend infrastructure.
• Write, review, test, and audit secure embedded software, including test harnesses, emulators, fuzzers, and fault-injection tooling.
• Threat-model hardware and software trust boundaries and convert findings into engineering improvements.
• Collaborate with hardware, firmware, infrastructure, application, security, and product teams to integrate secure-by-default capabilities.
• Help establish engineering standards for HSM development, applied cryptography, secure key management, and certificate infrastructure.

Requirements

• At least 5 years of experience building secure embedded firmware for constrained environments.
• Deep programming experience in C, C++, or Rust.
• Experience designing, implementing, debugging, and shipping production systems software.
• Hands-on experience with security-critical software or firmware within or adjacent to an HSM, secure element, trusted execution environment, or hardware root of trust.
• Strong knowledge of applied cryptography, digital signatures, key hierarchies, secure key management, and cryptographic protocol design.
• Experience with PKI, X.509 certificates, certificate authorities, certificate issuance, and certificate lifecycle protocols.
• Familiarity with secure boot, measured boot, device identity, remote attestation, or hardware-backed storage.
• Ability to reason about concurrency, memory safety, privilege separation, hardware interfaces, failure modes, side-channel risks, and physical attack considerations.
• Ability to evaluate security designs and personally implement the required software.
• Clear communication and cross-functional collaboration skills.
• Helpful additional experience includes ARM TrustZone or other trusted execution environments; commercial or cloud HSM platforms; PKCS#11, KMIP, OpenSSL providers or engines; secure-element APIs; device manufacturing and secure provisioning; boot ROM, bootloader, firmware signing, anti-rollback, authenticated updates; cryptographic accelerators or custom silicon; multi-party authorization; tamper-resistant audit mechanisms; and high-assurance production security software.