Sr Software Engineer – Secure Signing Infrastructure

Blue Origin•Cupertino, CA

About The Position

Blue Origin is hiring a Senior Software Engineer to design, develop, deploy, and operate secure signing infrastructure for TeraWave custom silicon and embedded systems. The role focuses on highly available network-based services that sign and encrypt firmware binaries for local developer workflows and automated CI/CD build and release pipelines. The engineer will work with security, silicon, firmware, software, manufacturing, and infrastructure teams to protect signing keys and cryptographic operations while providing reliable, scalable signing services to engineering teams across multiple geographic locations. The position supports the evolution of signing infrastructure from development through production, manufacturing, and silicon bring-up. Relocation is provided, travel is expected up to 20% of the time, and interviews include a technical assessment.

Requirements

Bachelor's degree in Computer Science, Computer Engineering, Electrical Engineering, or a related technical discipline.
At least 5 years of professional software engineering experience.
Experience designing, developing, and operating high-reliability network-based or backend services in self-hosted or cloud-based environments.
Strong software development and debugging skills.
Experience implementing or managing authentication services, authorization mechanisms, and credentials.
Experience developing monitoring, health checks, logging, and alarming for production network services.
Experience integrating software services with automated build, release, or CI/CD environments.
Experience designing software for reliability, availability, scalability, and operational support.
Ability to collaborate across software, infrastructure, security, firmware, silicon, and embedded engineering teams.
Interest and willingness to develop expertise in security infrastructure, cryptography, HSMs, and secure signing systems.
Must be a U.S. citizen or national, U.S. permanent resident (current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum.

Nice To Haves

Experience using PKCS#11 APIs from Python, Java, C/C++, or similar languages.
Experience configuring, administering, or developing software interfaces to Hardware Security Modules (HSMs).
Strong understanding of cryptography, including encryption, digital signatures, hashing, key exchange, and secure communications.
Knowledge of X.509 certificates, certificate authorities, trust chains, key management, revocation, and certificate lifecycle management.
Familiarity with post-quantum cryptographic algorithms.
Familiarity with Executable and Linkable Format (ELF) binaries and embedded firmware build processes.
Experience with GitLab CI or similar CI/CD systems.
Experience deploying and operating distributed services across multiple geographic locations.
Experience with firmware signing, secure boot, OTA firmware-update signing, or related embedded security infrastructure.

Responsibilities

Design, develop, deploy, and maintain highly available network-based services for signing and encrypting firmware binaries.
Develop secure signing workflows for local developer environments and automated CI/CD build and release pipelines.
Design and implement authentication and authorization mechanisms that restrict access to signing operations and cryptographic keys to authorized users and systems.
Configure, integrate with, and manage Hardware Security Modules (HSMs) used to store and operate on cryptographic key material.
Develop software interfaces and services for interacting with HSMs and cryptographic infrastructure.
Develop monitoring, health and status reporting, logging, alarming, and operational tooling for signing infrastructure.
Design and scale signing services for dozens to hundreds of engineers across multiple geographic locations.
Maintain appropriate separation and security controls between development and production signing environments.
Troubleshoot signing-related build, deployment, authentication, and infrastructure issues, collaborating across engineering disciplines to resolve them.
Integrate signing infrastructure with firmware build, release, and deployment systems.
Work with security engineers to implement cryptographic, key-management, authentication, and infrastructure-security requirements.
Evaluate third-party signing and security infrastructure solutions, support technical trade studies and proof-of-concept integrations, and contribute to build-versus-buy decisions.
Support the evolution of signing infrastructure from development through production, manufacturing, and silicon bring-up.

Benefits

Medical, dental, and vision insurance.
Basic and supplemental life insurance.
Paid parental leave.
Short- and long-term disability.
401(k) with a company match of up to 5%.
Education Support Program.
Stock options for all regular employees working at least 20 hours per week.
Up to four weeks of paid time off per year based on weekly scheduled hours.
Up to 14 company-paid holidays.
Depending on role type and job level, employees may be eligible for benefits and bonuses based on individual contributions and company results or other factors.