Sobre esta vaga de Security Certification Engineer - Android, Common Criteria & FIPS 140-3 na Samsung Research America
Location:
Mountain View, CA or Open to Remote
Lab Summary:
Are you passionate about transforming bleeding-edge technologies into services that will impact millions in our daily lives? At Mobile Platform Solutions (MPS), we are looking for passionate product managers to share their creative vision and to build applications and services for Samsung's array of devices spanning mobile, wearables, IoT, TVs, appliances, etc. In this position, you will join a collaborative team of world-class designers, researchers, and engineers in the field of AI/ML, blockchain, IAM, computer vision, AR/VR/XR, IOT technologies, with emphasis on mobile B2B services, security and privacy, Enterprise AI, etc.
Come join the Samsung MPS team and be a leader in bringing futuristic services to life!
Position Summary:
The Security Certification Engineer is an individual contributor (100% hands on security engineering) role dedicated to certifying Mobile Device, File Encryption (Samsung Products) using US security certification standards Common Criteria (NIAP) and FIPS 140-3 cryptographic certifications across our mobile device ecosystem.
Position Responsibilities:
- Security Engineering: This position requires working knowledge of the Android Framework, Linux kernel security, some level of ability to perform code level analysis of the Android Framework, ability to trace and debug security controls across the Android OS Framework (AOSP), BoringSSL/OpenSSL, Keystore, StrongBox/TEE, SELinux policies, and native C/C++ cryptographic libraries. Ability to Perform source code and protocol level analysis to ensure compliance to the specifications.
- Common Criteria (NIAP): Drive hands on evaluations against Mobile Device Fundamentals Protection Profile (MDFPP), Application Software PP (App PP), Functional Package for TLS (PKG_TLS), and VPN Client (MOD_VPNC). Assist in the development and review of all test reports and required certification documentation for all the Common Criteria evaluations and FIPS 140-2/3 accreditation.
- Technical Documentation Authorship: Independently author, draft, update evaluate all documentation artifacts, for CC specifically Security Targets (ST), Key Management Descriptions (KMD), Entropy Documentation and Administrative/Operational User Guidance (AGD). FIPS 140-3 evaluations draft all the complete Security Policies, create JSON vectors for the cryptographic modules. Develop mitigation strategies to address vulnerabilities uncovered during security testing; and assist with completing all the required documentation to meet the specifications and certification requirements, as required.
- Perf FIPS 140-3 Cryptographic Module Validation: Execute every technical step of NIST CMVP/CAVP certification (ISO/IEC 19790). Draft the complete FIPS 140-3 Security Policies, configure and run Automated Cryptographic Validation Protocol (ACVP) JSON test harnesses, validate algorithm implementations (CAVP), support and resolve all the lab testing issues and address CMVP feedback. Perform vulnerability analysis of product or system designs against applicable security criteria using common tools, including Nessus, NMAP, and Wireshark.
- Cross Functional & Offshore Execution: Experience with tools like Jira to manage certification tasks, vulnerability remediation and feature tracking across all our certification products distributed our global teams. (Primary South Korea, India, Ukraine, the United Kingdom, and the United States)
- Global Schedule Adaptability: Ability to participate in technical or other working sessions across international time zones outside standard 8:00 AM – 5:00 PM local hours as required by global product release milestones.
Required Skills:
- Bachelor's degree in Computer Science or a related engineering discipline. A Master's or Ph.D. in Computer Science or Security is preferred, or an equivalent combination of education, training, and experience
- 3+ years of direct, hands-on engineering experience in Common Criteria and/or FIPS 140-3 certification
- Strong knowledge of common security related protocols and their design (i.e., SSH, IPsec, TLS, etc.)
- Comprehensive understanding of Android Framework architecture, CC specifications, and FIPS 140-3 (ISO/IEC 19790). Familiarity with NIST SP 800-series standards, ACVP JSON tooling, and Jira workflow management
Additional Information
Disclosure of Trade Secrets
Samsung has a strict policy on trade secrets. In applying to Samsung and progressing through the recruitment process, you must not disclose any trade secrets of a current or previous employer.
Essential Job Functions
This position will be performed in an office setting. The position will require the incumbent to sit and stand at a desk, communicate in person and by telephone, and frequently operate standard office equipment, such as telephones and computers.
Samsung Research America is committed to complying with all Federal, State and local laws related to the employment of qualified individuals with disabilities. If you are an individual with a disability and would like to request a reasonable accommodation as part of the employment selection process, please contact the recruiter or email sratalent@samsung.com.
Equal Employment Opportunity
At Samsung, we believe that innovation and growth are driven by an inclusive culture and a diverse workforce. We aim to create a global team where everyone belongs and has equal opportunities, inspiring our talent to be their true selves. Together, we are building a better tomorrow for our customers, partners, and communities.
Samsung Research America is committed to employing a diverse workforce, and provide Equal Employment Opportunity for all individuals regardless of race, color, religion, gender, age, national origin, marital status, sexual orientation, gender identity, status as a protected veteran, genetic information, status as a qualified individual with a disability, or any other characteristic protected by law.
For more information regarding protection from discrimination under Federal law for applicants and employees, please refer to this link: Pay Transparency
