Stratitech Services LLC

Senior Embedded Firmware Security Engineer — Secure Boot &amp; TEE
Location:
Foster City, CA
Employment Type:
Contract
Work Arrangement:
Onsite 4 days per week
Compensation
: 225,000–300,000 annualized base compensation, plus benefits
Work Authorization:
Candidates must be currently authorized to work in the United States. This position is not eligible for new or future employer-sponsored work authorization.
Note: No C2C arrangements will be considered.
Third-party recruiters and agencies:
Do not search for or use personal contact information belonging to StratITech employees, representatives, or their family or household members. Any attempt to use personal or household contact information for solicitation, candidate submission, or vendor outreach is strictly prohibited and will be reported to LinkedIn.
About the Role
StratITech is supporting an innovative autonomous-vehicle technology company seeking a
Senior Embedded Firmware Security Engineer
to help build and strengthen the security foundation of next-generation embedded systems.
This is a deeply hands-on engineering role working at the intersection of
firmware, boot security, trusted execution, hardware security, and Embedded Linux
.
The strongest candidates will have personally built, integrated, or materially modified security mechanisms at the
boot and firmware trust boundary
—including Secure Boot, verified boot chains, bootloader security, hardware Root of Trust, Trusted Execution Environments, or comparable hardware-isolated security technologies.
You do not need experience with every technology listed below.
We are particularly interested in engineers with deep experience across
Secure Boot/Root of Trust, boot or early-boot firmware, trusted execution, and low-level C/C++ development. Equivalent technologies and implementations are absolutely relevant.
What You’ll Do
<ul>
<li>Design and implement security architecture for production embedded platforms.</li>
<li>Build, integrate, or enhance
Secure Boot and verified boot chains
, from hardware Root of Trust and early boot through the operating system.</li>
<li>Work directly with bootloader and early-boot environments such as
U-Boot, UEFI/EDK2, ARM Trusted Firmware, Android Verified Boot, BootROM, PBL/SBL, or proprietary equivalents
.</li>
<li>Develop and integrate security functionality involving
Trusted Execution Environments, ARM TrustZone, secure processors, Secure World components, or other hardware-isolated execution environments
.</li>
<li>Write and debug low-level
C/C++ firmware and systems software
on ARM-based platforms.</li>
<li>Work across hardware, firmware, bootloader, kernel, and userspace boundaries to diagnose complex security and integration issues.</li>
<li>Help protect cryptographic keys, signed firmware, system images, and device identity throughout the device lifecycle.</li>
<li>Contribute to secure firmware update, recovery, provisioning, and rollback-protection mechanisms.</li>
<li>Partner closely with firmware, platform, hardware, systems, and security engineers to move security designs into production.</li>
</ul>
Required Qualifications
<ul>
<li>Approximately
6+ years of experience
in embedded systems, firmware, Embedded Linux, BSP, kernel, system software, or closely related low-level engineering. Exceptional candidates with slightly less experience and unusually strong embedded-security depth may also be considered.</li>
<li>Strong hands-on
C/C++
development experience in embedded or systems environments.</li>
<li>Production experience implementing, integrating, or significantly modifying
Secure Boot, verified boot, chain-of-trust, or hardware Root-of-Trust technologies
.</li>
<li>Hands-on experience with
bootloaders or early-boot firmware
.</li>
<li>Experience with a
Trusted Execution Environment, Secure World, secure processor, Secure Enclave, or comparable hardware-isolated security environment
.</li>
<li>Experience securing
physical production hardware
, rather than exclusively cloud, application, or enterprise security systems.</li>
<li>Strong understanding of ARM-based embedded systems and hardware/software interaction.</li>
<li>Ability to troubleshoot complex issues across multiple system layers and clearly explain your technical ownership.</li>
</ul>
Relevant Technology Experience
Experience with any combination of the following is valuable.
These are not intended as a checklist, and exact technology matches are not required.
<ul>
<li>Trusted execution:
OP-TEE, ARM TrustZone, QSEE/QTEE, Trusty, GlobalPlatform, KeyMint/Keymaster, secure processors, Secure Enclaves</li>
<li>Boot and platform security:
U-Boot, Barebox, UEFI/EDK2, TF-A, AVB/AVB2, BootROM, LK/ABL, PBL/SBL</li>
<li>Linux/Android platform security:
SELinux, AppArmor, dm-verity, dm-crypt, IMA/EVM</li>
<li>System isolation:
cgroups, namespaces, seccomp, containers or comparable isolation mechanisms</li>
<li>Embedded platforms:
Embedded Linux, Android/AOSP, QNX, Yocto, Buildroot</li>
<li>Hardware security:
TPM, HSM, secure elements, hardware-backed keys, eFuse, OTP</li>
<li>Cryptography and signing:
PKI, SHA-256/384, certificate chains, firmware signing, key lifecycle management</li>
<li>Manufacturing security:
device provisioning, key injection, fuse programming, secure manufacturing or end-of-line security</li>
<li>Updates and recovery:
secure OTA, A/B updates, rollback protection, anti-rollback counters, recovery systems</li>
<li>Python or Bash for tooling, automation, testing, or integration</li>
</ul>
What Will Make You Stand Out
We are especially interested in engineers who can point to a production system and explain:
<ul>
<li>What part of the Secure Boot or verified chain they personally built or modified</li>
<li>Which bootloader or early-boot components they worked in</li>
<li>What they implemented inside a TEE, Secure World, secure processor, or comparable environment</li>
<li>What low-level C/C++ code they personally wrote</li>
<li>How they debugged problems spanning hardware, boot firmware, kernel, and userspace</li>
</ul>
Experience in
automotive, autonomous systems, robotics, semiconductor, mobile devices, aerospace, IoT, or other security-sensitive embedded products
is particularly relevant.
Location
This position requires working onsite in
Foster City, California, four days per week
.
Candidates currently located elsewhere in the United States may be considered if they are willing and able to relocate to the San Francisco Bay Area.
Relocation assistance is not available, and relocation would be at the candidate’s own expense.

Senior Embedded Firmware Security Engineer — Secure Boot & TEE

Senior Embedded Firmware Security Engineer — Secure Boot & TEE

This job is no longer available

Talents

Recruiters

About