Embedded Linux Security Engineer

ALTEN Technology USA • Foster City, CA

13d • $150,000 - $160,000 • Onsite

About The Position

ALTEN Technology USA is seeking an Embedded Linux Security Engineer to implement security solutions that harden a next-generation embedded Linux platform. The role bridges low-level hardware security, kernel hardening, and secure user-space application containment. The engineer will design cryptographic defenses, automate security pipelines in CI/CD, and work with manufacturing teams to provision devices securely and reliably at scale while avoiding production risks.

The position is on-site five days per week in Foster City, California, with a stated salary range of $150,000–$160,000. Candidates selected for employment must successfully complete a pre-employment drug screening.

Requirements

• Bachelor’s degree in Computer Science, Computer Engineering, Electrical Engineering, or a related technical discipline, or equivalent practical experience.
• At least 6 years of professional experience in Embedded Linux development, board bring-up, and Board Support Package (BSP) customization.
• At least 3 years of hands-on experience deploying device-level security features into physical production hardware.
• Expert knowledge of bootloader configurations such as U-Boot Verified Boot or Barebox, and Linux kernel storage/security subsystems such as dm-crypt and dm-verity.
• Deep understanding of modern processor security architectures, particularly ARM TrustZone (ARMv7-A/ARMv8-A and Exception Levels EL1–EL3).
• Proven experience implementing SELinux/AppArmor policies and using Linux containment tools such as cgroups and namespaces.
• Proficiency with embedded Linux build automation frameworks such as Yocto Project (including BitBake recipe design) or Buildroot.
• Advanced proficiency in C and strong scripting skills in Python or Bash.

Nice To Haves

• Foundational knowledge of symmetric and asymmetric cryptography, SHA-256/384 hashing, public key infrastructure (PKI), and handling physical Hardware Security Modules (HSMs).
• Experience working with Contract Manufacturers or internal factory lines to deploy secure key-injection and fuse-burning protocols.
• Experience with embedded container runtimes such as LXC or crun, or lightweight sandboxing frameworks for resource-constrained architectures.
• Experience designing secure versioning and hardware-enforced anti-rollback strategies for OTA updates.

Responsibilities

• Design and implement Hardware Root of Trust and Secure Boot architecture from the first-stage bootloader through the Linux kernel.
• Implement dm-verity for cryptographically verified read-only root filesystems and secure data encryption at rest.
• Develop, integrate, and maintain a Trusted Execution Environment (TEE), such as OP-TEE, and author Secure/Trusted Applications.
• Enforce user-space isolation and sandboxing using SELinux, AppArmor, cgroups, namespaces, and seccomp filters.
• Build automated cryptographic signing pipelines in CI/CD systems such as GitLab CI or GitHub Actions to sign bootloaders, kernels, and OTA payloads using HSMs or secure key vaults.
• Work with manufacturing teams to create scripts and tools for securely burning permanent hardware configuration fuses (eFuses/OTP memory), and design end-of-line test software to validate security features before shipping.
• Design multi-slot boot recovery layouts, such as A/B partitioning, to provide fail-safe recovery from failed OTA updates or corrupted boots.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior