> Markdown version of [/jobs/ext/4705033-security-engineer-devices](https://www.wearedevelopers.com/jobs/ext/4705033-security-engineer-devices). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer - Devices - **Company:** SOMANA LLC - **Location:** San Francisco, CA, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Board Bringup, Artificial Intelligence, Booting (BIOS), UClibc (C Standard Library), Cyber Security, Linux, Linux on Embedded Systems, Federal Information Processing Standards (FIPS), Firmware, Joint Test Action (IEEE Standards), Key Management, Packet Analyzer, Open Source Technology, Public Key Infrastructure, Regression Testing, Software Reliability Testing, Secure Coding, Software Vulnerability Management, Extensible Firmware Interface, PIC Microcontroller, Computer Equipment, Yocto, Information Technology, U-Boot, NVIDIA Jetson - **Published:** November 13, 2026 - **Apply:** https://www.careerbuilder.com/job-details/security-engineer-devices-san-francisco-ca--f44aac92-2386-4cc7-8d4d-2f3f33dc2493 ## About the Role Robotics, Artificial Intelligence (AI), Computer Systems, Peripheral Hardware, Team Player, Computer Hardware, Threat Modeling, Reliability Testing, Security Analysis, Manufacturing, * 4+ years of professional engineering experience with a focus on embedded systems, Linux, and/or established hardware * Hands-on experience implementing a secure boot chain on real production hardware: code signing, chain of trust, UEFI Secure Boot or related * Fluency with embedded systems: ARM SoCs, microcontrollers, bootloaders (U-Boot, TF-A), embedded Linux internals (boot flow, systemd, privilege boundaries, device access control), and the firmware build chain * Proficiency in C or Rust, plus the ability to work fluently in shell * Practical cryptographic engineering: PKI and certificate hierarchies, HSM or PKCS#11-backed signing, key lifecycle management, and full-disk encryption * Practical hardening and vulnerability-management experience on real deployed systems * Track record of taking security features from architecture through board bring-up to volume production * Ability to work independently as the security owner - this is a founding-level security function, not a seat on a large security org, * Experience with a specific SoC vendor's secure boot and fusing workflow (NVIDIA Jetson, NXP, Qualcomm, or similar) * Familiarity with measured boot, TPMs, and remote attestation * Declarative configuration and reproducible builds - Nix/NixOS is what we're most excited to see; adjacent depth in Bazel, Buildroot, or Yocto is a solid substitute * Offensive security experience, including hardware attacks: bus sniffing, fault injection, glitching, DPA/SPA, JTAG and boot interruption * Background securing devices in physically accessible, customer-operated environments (tamper-evident packaging, secure enclosures, physical access threats) * Experience with confidential computing or secure OS foundations * Experience with SOC, FIPS 140-3 or Common Criteria certification processes * Contributions to the security community - CVEs, conference talks or open-source tooling ## Description * Own the trusted boot chain across our compute generations: signed firmware and bootloaders, vendor secure boot (fusing workflows included), signed kernel and root filesystem verification, and full-disk encryption with automated unlock * Own signing key management and the infrastructure behind it: HSM-backed signing keys, separation of development and production trust roots, key rotation, and build-time enforcement that the right keys sign the right artifacts * Define and implement hardening postures for our devices - network exposure, privilege boundaries, and the difference between a locked-down fielded unit at a customer site and a debuggable bench unit in the lab * Lead threat analysis and security architecture for the compute and edge devices we design and build in-house, deployed in physically accessible industrial and manufacturing environments * Drive vulnerability management for the fielded fleet: CVE triage against kernel and userspace, patching strategy for deployed hardware, and a clear picture of fleet security state * Work hands-on with firmware and platform teams to embed security into the development process - secure coding standards, design reviews and regression testing * Explain security decisions to the engineers who implement them and to the stakeholders who accept the residual risk * Support supply chain security: component vetting, artifact provenance, and anti-counterfeiting / anti-tamper measures * Contribute to compliance and certification work as needed (e.g. FIPS 140-3, Common Criteria, NIST frameworks)