← All roles

Systems Software Engineer, Security, First Party Hardware

OpenAI· Scaling
Apply on company site
Hybrid (San Francisco)$230k - $385kFull-timePosted 4mo ago

About the role

Security Engineer for OpenAI's First-Party Hardware team responsible for end-to-end security foundation of AI hardware systems, including boot integrity, device identity, provisioning, attestation, management-plane security, storage encryption, firmware update/recovery, RMA, and decommissioning, across hardware security, embedded security, and data-center deployment.

Responsibilities

  • Own security requirements, threat models, validation strategy, and launch-readiness evidence for first-party hardware platforms from early design through production deployment.
  • Design and review secure boot, measured boot, roots of trust, platform firmware resilience, firmware signing, recovery, and anti-rollback strategies across heterogeneous devices.
  • Own device identity, provisioning, enrollment, attestation, certificate lifecycle, and key-management requirements across manufacturing and data center bring-up.
  • Harden management interfaces and operational access paths across BMCs, hosts, accelerators, switches, and service tooling, including TLS/mTLS, Redfish, gNMI, SSH, syslog, and break-glass workflows.
  • Drive security requirements for manufacturing, supply chain, firmware/image signing, storage encryption, RMA, repair, and decommissioning processes.
  • Build and drive validation for security-critical hardware and firmware behavior, including debug lockout, lifecycle transitions, update paths, attestation evidence, and recovery flows.
  • Partner with vendors and contract manufacturers to turn security requirements into concrete deliverables, test evidence, and launch gates.
  • Drive end-to-end closure across design, implementation, manufacturing readiness, deployment readiness, fleet operations, and incident response when security issues arise.
  • Investigate hardware and firmware security issues, assess exploitability and operational risk, and drive durable fixes with engineering owners.

Qualifications

  • 7+ years of hands-on experience, or exceptional accomplishments demonstrating equivalent expertise, in hardware security, embedded security, firmware security, platform security, or low-level systems security.
  • Experience shipping or securing real hardware platforms, embedded devices, servers, accelerators, networking systems, BMCs, bootloaders, BIOS/UEFI, RTOS, kernels, or firmware update systems.
  • Deep familiarity with secure boot, measured boot, TPMs, hardware roots of trust, device attestation, key provisioning, debug interfaces, firmware signing, recovery, or lifecycle-state design.
  • Strong applied-cryptography judgment for secure boot, attestation, TLS/mTLS, key storage, certificate lifecycle, storage encryption, and long-range transitions such as post-quantum readiness.
  • Ability to read and write systems code in C, C++, or Rust and to use that skill to review, prototype, test, or debug security-critical behavior.
  • Comfort with hardware-software interfaces such as SPI, I2C, SMBus, PCIe, UART, JTAG, SWD, GPIOs, TPMs, and board-level debug tools.
  • Proven track record driving security improvements with hardware, firmware, infrastructure, manufacturing, operations, and partner teams.
  • Experience owning broad, ambiguous security programs end to end, including translating risk into technical requirements, validation plans, and accountable engineering decisions.
  • Clear written and verbal communication, with the ability to turn ambiguous security risks into actionable requirements, design reviews, tests, and decisions.

Skills

Required:Security requirements and threat modelingSecure boot and measured bootDevice identity and provisioningSecurity for management interfaces (TLS/mTLS, Redfish, SSH, etc.)

Benefits

  • Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts
  • Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)
  • 401(k) retirement plan with employer match
  • Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents), plus paid medical and caregiver leave (up to 8 weeks)
  • Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees
  • 13+ paid company holidays, and multiple paid coordinated company office closures throughout the year for focus and recharge, plus paid sick or safe time
  • Mental health and wellness support
  • Employer-paid basic life and disability coverage
  • Annual learning and development stipend
  • Daily meals in our offices, and meal delivery credits as eligible
  • Relocation support for eligible employees
  • Additional taxable fringe benefits, such as charitable donation matching and wellness stipends
Last updated Jul 16, 2026. Interested? Apply on the company site.

About OpenAI

ai-infrastructure-and-developmentliquid-ai-recruiting-targetllmsetter-30setter-30-2026-q1speech-to-texttext-to-speechvoice-ai-stack
Company profileWebsite

More open roles at OpenAI