Job description
Principal Platform Security Architect – C, C++. Yocto, BMC, BIOS, Linux – £130,000 - £170,000 plus equity - Cambridgeshire
We are looking for an experienced Platform Security Architect to oversee and improve security controls across platform firmware and embedded Linux environments.
This role combines hands-on engineering with high-level architecture across both embedded platforms (Yocto-based) and data center systems (BMC and platform firmware). You will design and secure low-level boot chains, firmware update mechanisms, and management plane subsystems while working alongside cross-functional engineering teams.
Key Responsibilities
We are looking for an experienced Platform Security Architect to oversee and improve security controls across platform firmware and embedded Linux environments.
This role combines hands-on engineering with high-level architecture across both embedded platforms (Yocto-based) and data center systems (BMC and platform firmware). You will design and secure low-level boot chains, firmware update mechanisms, and management plane subsystems while working alongside cross-functional engineering teams.
Key Responsibilities
- Evaluate and implement security mechanisms across BIOS, BMC, and device firmware.
- Secure boot flows, firmware signing, verification, rollback protection, and debug access.
- Harden embedded Linux environments through privilege management, service isolation, and attack surface reduction.
- Develop validation scripts/tools and integrate automated security testing into CI pipelines.
- Conduct threat modeling on low-level firmware and management plane architectures.
- Hands-on experience customizing embedded Linux using Yocto / OpenEmbedded.
- Deep understanding of BIOS/UEFI, bootloaders, and secure boot trust chains.
- Experience with firmware update mechanisms, verification, and rollback protection.
- Familiarity with architecture and early boot processes.
- Proficiency in C/C++ for systems/embedded development.
- Automation experience (Python, Bash, CI workflow integration).
- Solid understanding of Linux security principles and platform interconnects (e.g., PCIe).
- OpenBMC or ecosystem experience.
- Security features: SELinux, AppArmor, or Linux capabilities.
- Hardware Roots of Trust (TPM, DICE).
- Firmware fuzzing or static/dynamic security analysis.