Platform Software Security Engineer, Air Defense

Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology.

The Air Defense team builds robots that find other robots and knock them out of the sky. As a Platform Software Security Engineer, you will focus on product security for the Air Defense platforms, working hands-on with embedded Linux, firmware, and hardware interfaces.

Responsibilities

• Drive hands-on platform security work: updating firmware, improving encryption algorithms, updating fusing tools, and building and re-imaging towers through our NixOS-based image pipeline.
• Own the signed boot chain across compute generations: firmware and bootloader signing, UEFI Secure Boot key hierarchies, signed kernel and initrd, and full-disk encryption with automated unlock.
• Own signing key management and the infrastructure behind it: HSM-backed keys, separation of development and production trust roots, key rotation, and build-time enforcement that the right keys sign the right artifacts.
• Define and implement the platform's hardening postures, spanning network exposure and firewall policy, privilege and sudo restriction, serial console and USB lockdown, and the difference between a locked-down fielded system and a debuggable bench unit.
• Drive vulnerability management for the fielded fleet: track CVEs against our kernel and userspace, own the patching strategy for hardware approaching vendor end-of-life, and keep a clear picture of fleet security state.
• Serve as the technical interface between engineering, product, and program teams decomposing security requirements into concrete engineering tasks and driving them to completion across the platform.
• Partner with our product security organization to turn security requirements into shippable implementations, act as the team's security liaison, and support program-specific accreditation and exportability efforts as our international portfolio grows.

Requirements

• 4+ years of professional software engineering with a security focus on embedded Linux systems.
• Hands-on experience implementing a secure boot chain: code signing, chain of trust, UEFI Secure Boot or an equivalent vendor secure boot implementation.
• Practical cryptographic engineering skills: PKI and certificate hierarchies, HSM or PKCS#11-backed signing, key lifecycle management, and full-disk encryption.
• Strong Linux internals knowledge, particularly in patching, boot flow, kernel and initrd, systemd, privilege boundaries, and filesystem and device access control.
• Proficiency in C, C++, or Rust, plus the ability to work fluently in shell.
• Experience building or modifying embedded Linux system images,Yocto, Buildroot, or NixOS. Comfort working at the layer where OS configuration meets hardware bring-up.
• Practical hardening and vulnerability-management experience on real systems: attack-surface reduction, CVE triage on a deployed fleet, and live patching strategies that don't break the product.
• Ability to work hands-on with hardware,comfortable at a lab bench interfacing with compute boards, serial consoles, and firmware tooling.
• Ability to explain a security decision to engineers who need to implement it, and to a program stakeholder who needs to accept the residual risk.
• US person status required. Active US Secret clearance, or a previously granted Secret clearance eligible for reactivation.

Preferred Qualifications

• Experience with NVIDIA Jetson secure boot specifically, or with another SoC vendor's secure boot and fusing workflow.
• Familiarity with measured boot, TPMs, or remote attestation.
• Experience with NixOS or Nix for building system images. Adjacent depth in Yocto or Buildroot is a strong substitute,these are the most transferable skill sets to our NixOS-based platform.
• Background in defense or government accreditation processes, or work against a formal security controls framework. Experience with international exportability requirements is a plus.
• Offensive security experience, including hardware attacks such as bus sniffing, glitching, or JTAG and boot interruption.
• Experience with supply chain security, artifact provenance, or SBOM tooling.
• Experience bringing new hardware features to life through software,bridging the gap between hardware capabilities and the platform software that exercises them.

Benefits

• Competitive salary: $167,000-$222,000 USD
• Comprehensive benefits package