Systems Engineer - Linux Kernel & Virtualization

Summary

We're a well-funded, stealth startup building a new end-to-end personal computing platform based on our own custom silicon. As our Lead SoC Security Software Engineer, you will own the software foundation for our hardware security. You will operate at the intersection of firmware, silicon, and cryptography, architecting the systems that keep our platform private and tamper-proof. You will bridge the gap between hardware primitives and high-level software, ensuring our Root of Trust, secure media pathways, and secrets storage are secure by design.

Responsibilities

• Root of Trust & Secure Boot: Architect and implement the entire chain of trust from power-on, including TF-A, secure boot sequences, and hardware-backed verification.
• Secure Subsystem & Cryptography: Build the firmware for our Secure Subsystem / TEE to manage sensitive keys, execute cryptographic operations in isolation, and handle secure provisioning.
• Encrypted Media Pipelines: Design and enforce end-to-end encrypted pathways for high-value media, integrating DRM and HDCP frameworks while maintaining memory isolation from the application processor.
• Hardware/Software Co-Design: Work directly with the silicon and hardware teams to define security requirements for IP blocks, including OTP/eFuses, PUF, and crypto accelerators.
• Vulnerability Hardening: Proactively model threats and implement defenses against physical and logical attacks, including side-channel analysis and fault injection, to ensure our product stays resilient.

Minimum Requirements

• 6+ years in SoC/Embedded Security: Deep expertise in silicon-level security, firmware engineering, and building secure platforms.
• ARM Architecture Experience: Hands-on experience with ARM v8/v9, ARM TrustZone, and low-level firmware integration (TF-A, OP-TEE).
• Cryptography & Key Management: Practical experience implementing PKI, symmetric/asymmetric schemes, and hardware-based secret storage in production environments.
• Low-Level Software Fluency: Expert-level C or Rust programming for constrained environments; comfortable reading datasheets and debugging assembly.

Preferred Qualifications

• Experience implementing secure display/video paths, DRM, or memory isolation primitives.
• Experience hardening firmware against physical side-channel and fault-injection attacks.
• Background in Linux kernel security (dm-verity, module signing, hypervisors) or TEE development.
• Experience delivering firmware through the full silicon lifecycle, from tape-out and secure manufacturing to field deployment.
• Familiarity with Linux kernel fundamentals, KVM, eBPF, and security modules.