> Markdown version of [/jobs/ext/4629826-sr-security-test-engineer-device-os-pki-firmware-security](https://www.wearedevelopers.com/jobs/ext/4629826-sr-security-test-engineer-device-os-pki-firmware-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Sr. Security & Test Engineer - Device OS (PKI & Firmware Security) - **Company:** Fiserv, Inc. - **Location:** Sunnyvale, CA, United States - **Experience:** Expert - **Salary:** $140,000.0 - $210,000.0 - **Contract:** Permanent contract - **Skills:** Test Suite, Application Programming Interfaces (APIs), Android Software Development, Software System Penetration Testing, Automation of Tests, Bash Shell, Booting (BIOS), Software Bug Management, Burp Suite, Command-Line Interface, Software Quality, Computer Programming, Continuous Integration, Software Debugging, Linux, Digital Signature, Firmware, Fuzz Testing, Github, Hardware Security Module, Python (Programming Language), Key Management, Nmap, OpenSSL, Public Key Infrastructure, Clover, RSA (Cryptosystem), Security Software, Wireshark, Diagnostic Tools, Scripting, Delivery Pipeline, Software Security, GWAPT, Gitlab-ci, Selinux, Metasploit, SDET, Jenkins, Vulnerability Analysis - **Published:** November 7, 2026 - **Apply:** https://www.juju.com/job/1_ScrapingHub23766-FFFYJUSR10401285EXTERNALENUS ## About the Role + 5+ years of dedicated professional experience in Security Testing, Software Quality Engineering (SDET), Embedded Security, or Application Security (AppSec). + Hands-on Test Automation & Scripting: Strong programming skills in Python (plus Bash or Shell) to build automated test scripts, mock interfaces, and diagnostic test harnesses from scratch. + Applied Cryptography & PKI Testing: Deep technical understanding of how to test and validate cryptographic algorithms (AES, RSA, ECC, HMAC), TLS/mTLS handshakes, certificate authority (CA) chains, and HSM-backed key operations. + Operating Systems & Endpoint Debugging: Proven experience testing and debugging within Linux/UNIX or Android (AOSP) environments using command-line diagnostic tools (adb, Logcat, OpenSSL, Wireshark, system logs). + Vulnerability Analysis & Fuzzing: Demonstrated ability to perform hands-on security assessments using tools such as Burp Suite, OWASP ZAP, Nmap, Metasploit, or custom fuzzing scripts. + Secure CI/CD Integration: Experience integrating automated security checks, static/dynamic scanning, or automated regression runs into CI/CD build pipelines (Jenkins, GitHub Actions, GitLab CI). **Experience that would be great to have:** + Prior experience testing or certifying devices against payment industry standards: PCI-PTS, PCI-PIN, EMVCo, or Common Criteria. + Direct experience with Hardware Security Modules (HSMs), specifically validating secure factory key injection or PIN translation. + Hands-on familiarity with Android platform security internals (SELinux policy testing, verified boot / dm-verity, TrustZone, keystore). + Industry security certifications such as OSCP, CEH, GWAPT, CISSP, or equivalent practical security research experience. ## Description Sr. Security & Test Engineer - Device OS (PKI & Firmware Security) **About your role:** Clover, a Fiserv company, is a global leader in point-of-sale platforms powering millions of small businesses worldwide with integrated smart hardware, software, and secure payment solutions.In this role, you will join the DeviceOS Quality & Security Engineering team, which owns the low-level platform software, secure boot infrastructure, and factory-provisioning firmware powering millions of Clover devices. You will serve as the hands-on security validation lead responsible for designing security test harnesses, executing vulnerability and penetration testing, automating cryptographic test suites, and validating embedded PKI/HSM key injection architectures. If you are a builder and breaker who loves testing embedded security protocols, fuzzing device endpoints, and verifying hardware against strict payment security standards (PCI-PTS, PCI-PIN), this is your team. **What you'll do:** + Automated Security Test Engineering: Design, build, and maintain automated security test frameworks and test beds (in Python) to continuously validate platform security across Android (AOSP) and Linux-based POS smart terminals. + Cryptographic & Key Management Testing: Author automated test suites to validate cryptographic handshakes, TLS/mTLS configurations, digital signature verifications, and Hardware Security Module (HSM, e.g., Thales) key generation, injection, and rotation workflows. + Penetration Testing & Vulnerability Assessment: Conduct hands-on vulnerability assessments, API fuzzing, interface testing, and penetration testing against device operating systems, bootloaders, and local communication endpoints (USB, serial, network). + Compliance & Standards Verification: Translate PCI-PTS, PCI-PIN, and EMVCo security specifications into executable verification plans, validating device tamper responses, secure key storage, and PIN-entry security mechanisms. + Firmware & Supply Chain Security Validation: Build automated test gates within CI/CD pipelines (GitHub Actions/Jenkins) to scan golden images, audit kernel/bootloader integrity, verify Secure Boot chains, and detect supply-chain vulnerabilities before mass manufacturing. + Defect Triage & Security Root-Cause Analysis (RCA): Partner directly with embedded OS developers and firmware engineers to isolate, reproduce, and verify fixes for cryptographic flaws, security regressions, and Common Vulnerabilities and Exposures (CVEs)., Pay ranges for employees in other states may differ._ It is unlawful to discriminate against a prospective employee due to the individual's status as a veteran. For incentive eligible associates, the successful candidate is eligible for an annual incentive opportunity which may be delivered as a mix of cash bonus and equity awards in the Company's sole discretion. Thank you for considering employment with Fiserv. Please: + Apply using your legal name + Complete the step-by-step profile and attach your resume (either is acceptable, both are preferable). **Our commitment to Equal Opportunity:** Fiserv is proud to be an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, gender, gender identity, sexual orientation, age, disability, protected veteran status, or any other category protected by law. If you have a disability and require a reasonable accommodation in completing a job application or otherwise participating in the overall hiring process, please contact AskHR.US@fiserv.com . Please note our AskHR representatives do not have visibility to your application status. Current associates who require a workplace accommodation should refer to Fiserv's Disability Accommodation Policy for additional information. **Note to agencies:** Fiserv does not accept resume submissions from agencies outside of existing agreements. Please do not send resumes to Fiserv associates. Fiserv is not responsible for any fees associated with unsolicited resume submissions. **Warning about fake job posts:** Please be aware of fraudulent job postings that are not affiliated with Fiserv. Fraudulent job postings may be used by cyber criminals to target your personally identifiable information and/or to steal money or financial information. Any communications from a Fiserv representative will come from a legitimate Fiserv email address.