# Platform Software Security Engineer, Air Defense **Company**: Anduril Industries **Location**: Irvine, California **Experience**: senior **Job type**: full-time **Salary**: $167,000-$222,000 USD **Category**: Engineering **Industry**: Technology **Apply**: https://job-boards.greenhouse.io/andurilindustries/jobs/5295297007?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/job/platform-software-security-engineer-air-defense-46d4c46c-392/ ## Description Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. The Air Defense team builds robots that find other robots and knock them out of the sky. As a Platform Software Security Engineer, you will focus on product security for the Air Defense platforms, working hands-on with embedded Linux, firmware, and hardware interfaces. **Responsibilities** - Drive hands-on platform security work: updating firmware, improving encryption algorithms, updating fusing tools, and building and re-imaging towers through our NixOS-based image pipeline. - Own the signed boot chain across compute generations: firmware and bootloader signing, UEFI Secure Boot key hierarchies, signed kernel and initrd, and full-disk encryption with automated unlock. - Own signing key management and the infrastructure behind it: HSM-backed keys, separation of development and production trust roots, key rotation, and build-time enforcement that the right keys sign the right artifacts. - Define and implement the platform's hardening postures, spanning network exposure and firewall policy, privilege and sudo restriction, serial console and USB lockdown, and the difference between a locked-down fielded system and a debuggable bench unit. - Drive vulnerability management for the fielded fleet: track CVEs against our kernel and userspace, own the patching strategy for hardware approaching vendor end-of-life, and keep a clear picture of fleet security state. - Serve as the technical interface between engineering, product, and program teams decomposing security requirements into concrete engineering tasks and driving them to completion across the platform. - Partner with our product security organization to turn security requirements into shippable implementations, act as the team's security liaison, and support program-specific accreditation and exportability efforts as our international portfolio grows. **Requirements** - 4+ years of professional software engineering with a security focus on embedded Linux systems. - Hands-on experience implementing a secure boot chain: code signing, chain of trust, UEFI Secure Boot or an equivalent vendor secure boot implementation. - Practical cryptographic engineering skills: PKI and certificate hierarchies, HSM or PKCS#11-backed signing, key lifecycle management, and full-disk encryption. - Strong Linux internals knowledge, particularly in patching, boot flow, kernel and initrd, systemd, privilege boundaries, and filesystem and device access control. - Proficiency in C, C++, or Rust, plus the ability to work fluently in shell. - Experience building or modifying embedded Linux system images,Yocto, Buildroot, or NixOS. Comfort working at the layer where OS configuration meets hardware bring-up. - Practical hardening and vulnerability-management experience on real systems: attack-surface reduction, CVE triage on a deployed fleet, and live patching strategies that don't break the product. - Ability to work hands-on with hardware,comfortable at a lab bench interfacing with compute boards, serial consoles, and firmware tooling. - Ability to explain a security decision to engineers who need to implement it, and to a program stakeholder who needs to accept the residual risk. - US person status required. Active US Secret clearance, or a previously granted Secret clearance eligible for reactivation. **Preferred Qualifications** - Experience with NVIDIA Jetson secure boot specifically, or with another SoC vendor's secure boot and fusing workflow. - Familiarity with measured boot, TPMs, or remote attestation. - Experience with NixOS or Nix for building system images. Adjacent depth in Yocto or Buildroot is a strong substitute,these are the most transferable skill sets to our NixOS-based platform. - Background in defense or government accreditation processes, or work against a formal security controls framework. Experience with international exportability requirements is a plus. - Offensive security experience, including hardware attacks such as bus sniffing, glitching, or JTAG and boot interruption. - Experience with supply chain security, artifact provenance, or SBOM tooling. - Experience bringing new hardware features to life through software,bridging the gap between hardware capabilities and the platform software that exercises them. **Benefits** - Competitive salary: $167,000-$222,000 USD - Comprehensive benefits package For more fresh new jobs, check out [yubhub.co](https://yubhub.co/). ## Skills ### Required - embedded Linux - secure boot chain - cryptographic engineering - Linux internals - C - C++ - Rust - shell - Yocto - Buildroot - NixOS - hardening - vulnerability management ### Nice to have - NVIDIA Jetson secure boot - measured boot - TPMs - remote attestation - defense accreditation processes - international exportability requirements - offensive security - supply chain security - SBOM tooling --- Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/andurilindustries/jobs/5295297007?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)