Software Engineer, HSM Infrastructure Security

Responsibilities

• Design and implement security-critical software and firmware for HSMs, secure elements, trusted execution environments, and hardware roots of trust.
• Build and harden policy-to-HSM boundaries that authorize certificate issuance and cryptographic signing operations.
• Develop HSM trusted applications, firmware components, host interfaces, device drivers, SDKs, middleware, and cryptographic service integrations.
• Implement interfaces such as PKCS#11, OpenSSL providers or engines, platform key-storage APIs, and comparable hardware-security interfaces.
• Build systems enforcing key generation, provisioning, usage, rotation, recovery, and destruction policies.
• Design HSM-backed certificate authority, code-signing, key-management, device-identity, attestation, secure-boot, and provisioning systems.
• Develop cryptographic protocols spanning devices, secure hardware, policy services, and backend infrastructure.
• Write, review, test, and audit secure embedded software for resource-constrained environments.
• Develop test harnesses, emulators, fuzzers, and fault-injection tooling to validate security properties and failure behavior.
• Threat-model hardware and software trust boundaries and convert findings into engineering improvements.
• Collaborate with hardware, firmware, infrastructure, application, security, and product teams.
• Help establish engineering standards for HSM development, applied cryptography, secure key management, and certificate infrastructure.

Requirements

• At least 5 years of experience building secure embedded firmware for constrained environments.
• Deep programming experience in C, C++, or Rust.
• A strong track record designing, implementing, debugging, and shipping production systems software.
• Hands-on experience developing security-critical software or firmware within or directly adjacent to an HSM, secure element, trusted execution environment, or hardware root of trust.
• Strong knowledge of applied cryptography, digital signatures, key hierarchies, secure key management, and cryptographic protocol design.
• Experience with PKI, X.509 certificates, certificate authorities, certificate issuance, and certificate lifecycle protocols.
• Familiarity with secure boot, measured boot, device identity, remote attestation, or hardware-backed storage.
• Experience reasoning about concurrency, memory safety, privilege separation, hardware interfaces, failure modes, side-channel considerations, or physical attack considerations.
• Ability to evaluate security designs and personally implement the software required to realize them.
• Clear communication and cross-functional collaboration skills.
• Helpful experience includes ARM TrustZone, commercial or cloud HSM platforms, PKCS#11, KMIP, OpenSSL providers or engines, secure-element APIs, platform-native key-storage frameworks, device manufacturing, silicon bring-up, firmware signing, anti-rollback, authenticated updates, cryptographic accelerators, custom silicon, multi-party authorization, tamper-resistant audit mechanisms, attestable policy systems, hardware-protected storage, and high-assurance production security software.