Senior Platform Engineer, Embedded Linux & Security

Swan

25m ago

On-site

Full Time

San Francisco

Senior Platform Engineer, Embedded Linux & Security

About the role

This role secures embedded Linux devices and the infrastructure behind them, from boot and provisioning through release, deployment, and cloud services. You'll join a small engineering team as a senior individual contributor, working across device security, DevOps, and backend development.

What you'll do

Work with and improve secure device provisioning and hardware-backed security, including fusing, signing, device identity, secure boot, attestation, and disk encryption.
Help define and harden software release processes from source to device.
Help design device authentication and authorization services.
Harden device images and container runtimes, including mandatory access control such as AppArmor or SELinux.
Run services with least privilege: systemd sandboxing, non-root accounts, and correct file ownership and permissions.
Set SSH and firewall policy, and close debug paths such as UART, JTAG, and USB recovery.
Secure web services on devices and in the cloud with TLS and mTLS, reverse proxies, and least-privilege service accounts.
Threat model the platform, help scope pentests, and track vulnerabilities.
Plan security for partner engagements and third-party integrations: define requirements, review interfaces and data flows, and set access boundaries.
Help shape fleet management and over-the-air update approaches, from device enrollment through deployment.
Build cloud pipelines for device data and identity, with least-privilege access scoped to each device.
Contribute to arm64 build and image pipelines, including cross-compilation, QEMU-based builds and tests, multi-arch containers, and rootfs customization.
Write and maintain backend code for device and infrastructure tooling.

What you bring

6+ years of experience across Linux systems, security, and infrastructure engineering.
Strong working knowledge of hardware-backed security: secure boot chains, fused keys, TPMs and firmware TPMs, TEEs, attestation, and sealed storage.
Hands-on experience hardening Linux devices, containers, and services, with fluency in permissions, capabilities, and systemd.
Current knowledge of how to secure edge and IoT devices, such as A/B partitions, read-only root filesystems, and verified boot.
Confidence building and securing cloud infrastructure and CI/CD pipelines.
Solid coding skills for tooling and backend services, and the ability to review code for security issues.
Experience threat modeling systems and working with penetration testers or red teams.
A bias toward action: delivering on priorities with urgency, and proactively finding, raising, and fixing issues with the team along the way.

Nice to have

Hands-on implementation of secure boot, key fusing, or attestation on embedded hardware
Hands-on implementation of secure OTA updates, including fleet update tools such as Mender
ML model security on edge devices: current risks and mitigations
Embedded pentesting or red team work: UART and JTAG access, firmware extraction, rollback and recovery-mode attacks
Cloud security depth: serverless, IAM policy design, key management, device identity
Infrastructure as code with tools such as Terraform or Ansible
C++, Python
Experience in defense, export-controlled, or CMMC-regulated environments
Experience in a small, fast-paced startup environment
Familiarity with corporate security and IT infrastructure

Required Skills

linuxtlssystemdterraformansible

Required Languages

🇬🇧 English

What you'll do

Work with and improve secure device provisioning and hardware-backed security, including fusing, signing, device identity, secure boot, attestation, and disk encryption.

Help define and harden software release processes from source to device.

Help design device authentication and authorization services.

Harden device images and container runtimes, including mandatory access control such as AppArmor or SELinux.

Run services with least privilege: systemd sandboxing, non-root accounts, and correct file ownership and permissions.

Set SSH and firewall policy, and close debug paths such as UART, JTAG, and USB recovery.

Secure web services on devices and in the cloud with TLS and mTLS, reverse proxies, and least-privilege service accounts.

Threat model the platform, help scope pentests, and track vulnerabilities.

Plan security for partner engagements and third-party integrations: define requirements, review interfaces and data flows, and set access boundaries.

Help shape fleet management and over-the-air update approaches, from device enrollment through deployment.

Build cloud pipelines for device data and identity, with least-privilege access scoped to each device.

Contribute to arm64 build and image pipelines, including cross-compilation, QEMU-based builds and tests, multi-arch containers, and rootfs customization.

Write and maintain backend code for device and infrastructure tooling.

What you bring

6+ years of experience across Linux systems, security, and infrastructure engineering.

Strong working knowledge of hardware-backed security: secure boot chains, fused keys, TPMs and firmware TPMs, TEEs, attestation, and sealed storage.

Hands-on experience hardening Linux devices, containers, and services, with fluency in permissions, capabilities, and systemd.

Current knowledge of how to secure edge and IoT devices, such as A/B partitions, read-only root filesystems, and verified boot.

Confidence building and securing cloud infrastructure and CI/CD pipelines.

Solid coding skills for tooling and backend services, and the ability to review code for security issues.

Experience threat modeling systems and working with penetration testers or red teams.

A bias toward action: delivering on priorities with urgency, and proactively finding, raising, and fixing issues with the team along the way.

Nice to have

Hands-on implementation of secure boot, key fusing, or attestation on embedded hardware

Hands-on implementation of secure OTA updates, including fleet update tools such as Mender

ML model security on edge devices: current risks and mitigations

Embedded pentesting or red team work: UART and JTAG access, firmware extraction, rollback and recovery-mode attacks

Cloud security depth: serverless, IAM policy design, key management, device identity

Infrastructure as code with tools such as Terraform or Ansible

C++, Python

Experience in defense, export-controlled, or CMMC-regulated environments

Experience in a small, fast-paced startup environment

Familiarity with corporate security and IT infrastructure