Hyderabad, Telangana
Job Summary
Own the hardware root-of-trust to application-layer security chain on ARM-based heterogeneous SoC platforms used in industrial, robotics and connected edge products. The role covers secure/measured boot bring-up, TrustZone and Trusted Execution Environment enablement, key and certificate management, and secure device provisioning in high-volume manufacturing.
Key Responsibilities
Bring up and harden secure boot and measured boot chains across bootloaders, firmware and kernel on ARMv8-A/ARMv9 class SoCs.
Design, port and maintain TEE solutions (OP-TEE or equivalent) including Trusted Applications, secure storage and secure world–normal world communication.
Implement TrustZone-based isolation, secure memory partitioning and access control policies across CPU, DSP and accelerator subsystems.
Define and implement device identity, key provisioning, fusing and certificate flows for factory and field provisioning at scale.
Implement anti-rollback, debug lockdown, secure JTAG and lifecycle state management policies.
Support cryptographic acceleration enablement (crypto engines, RNG/TRNG, PKCS#11 / Keystore backends).
Contribute to threat modelling, security architecture reviews and vulnerability triage; support external security assessments and certification evidence.
Work with silicon vendor security documentation and escalate platform-level security defects; mentor engineers on secure coding practices.
Skill Requirements
8–10 years of embedded systems engineering with at least 4 years focused on platform security.
Strong C, with working ARM assembly and secure firmware debugging skills.
Hands-on secure boot / measured boot bring-up on ARM SoCs — chain of trust, image signing, verified boot.
Practical TrustZone and TEE experience: OP-TEE, GlobalPlatform TEE APIs, Trusted Application development.
Applied cryptography fundamentals — AES, RSA/ECC, SHA, HMAC, key derivation, PKI and certificate chains.
Bootloader internals (U-Boot / ABL / TF-A class), device tree and early-boot debug using JTAG and serial consoles.
Understanding of secure provisioning in manufacturing — eFuse/OTP programming, HSM-backed signing infrastructure.
Other Requirements
Exposure to Android Verified Boot, Keymaster/KeyMint, StrongBox or Windows-based secure boot flows.
Familiarity with security standards and certification regimes such as IEC 62443, FIPS 140-3, SESIP or PSA Certified.
Experience with hypervisor-assisted isolation and secure virtualization.
Fuzzing, static analysis and secure SDLC tooling.
#body.unify div.unify-button-container .unify-apply-now: focus, #body.unify div.unify-button-container .unify-apply-#body.unify div.unify-button-container .unify-apply-now: focus, #body.unify div.unify-button-container .unify-apply-