Embedded Security Engineer

Thistle Technologies empowers developers to easily build security resilience into their products. Embedded devices face the same threats as servers and workstations but often without the modern security mitigations to match. Thistle Technologies makes it easy to incorporate robust resilient security functionality into devices with high-security requirements.

Responsibilities

• Take product concepts in device security from incubation to demonstration, and eventually to production
• Co-maintain existing product features in the Thistle Security Platform
• Design, develop, deploy and maintain new device security features to evolve and shape the Thistle Security Platform
• Collaborate closely with backend engineers, product, and business development. Support sales calls as needed
• Engage with open source and developer communities to advocate and demonstrate Thistle Security Platform's capabilities with respect to device security

Qualifications

• 8+ years of experience building and shipping production software in the embedded security area
• Professional experience of low-level embedded software development in C/C++ or Rust, also including ability to set up CI/CD pipelines for automated testing and deployment
• Interest in opportunities and challenges in a startup environment, with respect to product building
• Deep knowledge of hardware security mechanisms, in particular, secure boot, trusted execution environment, inter-processor communications, and debugging interfaces. Hands-on experience with them
• Deep knowledge of embedded firmware and operating system security principles
• Understanding of cryptography primitives for data authenticity and confidentiality, as well as implementation experience with respect to their applications under different circumstances.
• Familiarity with the concepts of PKI, secure communication, key derivation and key management.
• Fluency in conventional applied cryptography such as AES, hashing, ECC and RSA; basic knowledge of quantum-safe cryptography
• Software security experience, specifically, exploitation techniques in embedded systems, reverse engineering in firmware, and design and development of anti-exploitation countermeasures

Strong Pluses

• Experience in device key provisioning systems in a manufacturing environment
• Experience in manual or automated security testing of embedded systems
• Experience in manual and code-scanner assisted security code review and vulnerability triaging
• Experience in building code signing tools/systems using secure hardware, hardware security modules or Cloud-based key management systems