Senior Embedded Security Engineer at True Anomaly

Denver, CO or Long Beach, CAFull-timeCybersecurityPosted 6 months ago

About the Role

<div class="content-intro">Space is a warfighting domain. True Anomaly seeks those with the talent and ambition to build the technology that secures it. OUR MISSION True Anomaly delivers decisive capabilities for space superiority. We build autonomous spacecraft, advanced payloads, mission software, and space-based interceptors — enabling the U.S. and its Allies to secure the space environment and counter threats from the ultimate high ground. OUR VALUES <ul> <li class="ms-outlook-mobile-reference-message">Be the offset. We create asymmetric advantages with creativity and ingenuity.</li> <li class="ms-outlook-mobile-reference-message">What would it take? We challenge assumptions to deliver ambitious results.</li> <li class="ms-outlook-mobile-reference-message">It’s the people. Our team is our competitive advantage and we are better together.</li> </ul> BENEFITS & PERKS* <ul> <li>Best-in-class healthcare: 100% company-paid medical, dental, and vision coverage for you and your dependents, with HSA/HRA options</li> <li>Generous time off: Flexible Time Off (FTO) for exempt employees, accrued PTO of up to 25 days for non-exempt employees, plus 12 paid holidays; Parental Leave; Sick Leave</li> <li>Fuel for your day: Daily catered lunch and unlimited snacks for in-office employees</li> <li>And more: 401(k) retirement plan, fitness reimbursement, and Dog Fridays</li> <li>Equity participation: Equity is included as part of our total compensation package, giving you an opportunity to share in the company’s success.</li> </ul> *Do not apply to fixed term and temporary roles</div>YOUR MISSION Your job is to find the weaknesses in our spacecraft before an adversary does. These vehicles operate in remote, contested environments, where a defect can mean loss of mission. Once one is on orbit you do not get it back, you do not get a patch window on your terms, and you do not get a second opinion. Your job is to find every weakness in the silicon, the firmware, the radios, and the software before the vehicle leaves the ground. What survives your test program could become a mission failure on orbit.  You will take flight hardware apart, with physical access being the beginning of the exercise rather than the end of it. Once you are on the board, we expect you to pivot to the software and go for root. Chain the bugs, escalate, persist, and prove out the full path an adversary would take. You will deliver the findings and the reproducible test plans that show our flight software and hardware engineers exactly where they stand, then work alongside them to close what you found.  This is an ideal role for someone who works at the intersection of hardware and software security, who would rather break a system than read about it being broken, and who wants that work to matter on a vehicle that cannot be recalled. It carries significant technical ownership and direct access to the engineers building the vehicles.  This position requires the ability to obtain and maintain a TS/SCI security clearance.  Responsibilities  Own the capability  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="1" data-aria-level="1">Advance True Anomaly's hardware security lab: tooling selection, bench design, budget case, and test methodology </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="2" data-aria-level="1">Own the security test plan for spacecraft hardware, radios, and flight software, and the schedule it runs on </li> </ul> Hardware and radios  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="3" data-aria-level="1">Perform invasive and non-invasive hardware attacks against flight hardware: side-channel analysis, fault injection (voltage, clock, EM), chip desoldering and rework, decapping, and exploitation of embedded debug and bus interfaces (JTAG, SWD, UART, SPI, I2C) </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="4" data-aria-level="1">Extract and reverse engineer firmware across the architectures our hardware runs on </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="5" data-aria-level="1">Analyze wired and wireless protocols, including RF links, proprietary protocols, and spacecraft command and telemetry paths </li> </ul> Software  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="6" data-aria-level="1">Pivot from hardware access to software exploitation: identify memory corruption and logic flaws, chain them, and escalate toward full system control </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="7" data-aria-level="1">Build coverage-guided and protocol fuzzing harnesses (AFL++, libFuzzer) and emulation-based rigs (QEMU, Unicorn) to decouple testing from hardware availability </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="8" data-aria-level="1">Root-cause findings and develop proof-of-concept exploits that demonstrate real impact and drive remediation priority </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="9" data-aria-level="1">Assess post-exploitation impact and the effectiveness of isolation, key handling, and recovery mechanisms </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="10" data-aria-level="1">Conduct security code review of flight software in C/C++ alongside binary analysis </li> </ul> Close the loop  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="11" data-aria-level="1">Publish findings with reproducible test plans, retest after remediation, and build automated triage and coverage analysis to keep results legible at scale </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="12" data-aria-level="1">Work with flight software and hardware engineers to implement fixes across memory safety, secure boot, cryptographic key management, and runtime hardening </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="13" data-aria-level="1">Perform threat modeling and security architecture review accounting for a sophisticated adversary and a non-recoverable asset </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="14" data-aria-level="1">Integrate security testing into HIL/SIL infrastructure and CI/CD pipelines, and support operational spacecraft with monitoring and incident response </li> </ul> Qualifications  Strong candidates tend to arrive from one of two directions: embedded systems engineers who moved into offensive security, or hardware and firmware security researchers who can write and review production C/C++. Real depth on both sides is rare and we are not expecting it on day one. Tell us which side you come from.  A good candidate will have:  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="15" data-aria-level="1">5+ years of hands-on experience across embedded systems security, hardware security, or offensive security against firmware and embedded targets </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="16" data-aria-level="1">Hands-on offensive hardware experience on real boards, including side-channel analysis, voltage or clock glitching, electromagnetic fault injection, chip desoldering and rework, and decapping </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="17" data-aria-level="1">Practical experience attacking embedded debug and bus interfaces (JTAG, SWD, UART, SPI, I2C), including sniffing, injection, and firmware extraction </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="18" data-aria-level="1">A track record of independently discovering, validating, and root-causing vulnerabilities in embedded systems, firmware, or hardware </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="19" data-aria-level="1">Firmware reverse engineering across common embedded architectures, using tools such as Ghidra, IDA, or binwalk </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="20" data-aria-level="1">Solid grounding in exploitation fundamentals on constrained targets: memory corruption, exploit primitives, the mitigations you will run into, and escalation toward full system control </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="21" data-aria-level="1">Experience building your own tooling rather than only running off-the-shelf tools: coverage-guided or protocol fuzzing harnesses (AFL++, libFuzzer), emulation-based rigs (QEMU, Unicorn), test fixtures, and bench instrumentation </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="22" data-aria-level="1">Experience analyzing protocols, wired or wireless or proprietary, and reasoning about both design and implementation weaknesses </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="23" data-aria-level="1">Strong C/C++ skills with deep understanding of memory safety and secure coding practices, sufficient to review flight software at the source level </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="24" data-aria-level="1">Working understanding of hardware root of trust and secure boot, whether from implementing them or from breaking them </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="25" data-aria-level="1">Proficiency with embedded toolchains, debuggers, static analysis tools, oscilloscopes, and logic analyzers, backed by strong debugging skills </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="26" data-aria-level="1">Ability to obtain and maintain a TS/SCI security clearance </li> </ul> An ideal candidate will also have:  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="27" data-aria-level="1">An already-active TS/SCI security clearance </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="28" data-aria-level="1">Experience using Ghommit tool. </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="29" data-aria-level="1">Direct experience in spacecraft or satellite embedded software, or other aerospace safety-critical systems </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="30" data-aria-level="1">Experience with RF and wireless security, or with software-defined radio (SDR) </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="31" data-aria-level="1">Experience attacking or securing real-time and safety-critical systems, including timing constraints, deterministic execution, and interrupt handling </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="32" data-aria-level="1">Experience implementing secure firmware update mechanisms and anti-tamper techniques </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="33" data-aria-level="1">Experience implementing a hardware root of trust, secure boot, or key provisioning on a shipped product </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="34" data-aria-level="1">Knowledge of hardware security modules (HSMs) and secure elements </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="35" data-aria-level="1">Experience with HIL or SIL test infrastructure and embedded Linux build systems (Yocto, NixOS) </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="36" data-aria-level="1">Familiarity with space-specific protocols and standards (CCSDS, ECSS) </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="37" data-aria-level="1">A public track record of impact: CVEs, published research, conference talks, CTF results, or open-source security tooling </li> </ul> Compensation  Base Salary  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="38" data-aria-level="1">Long Beach, CA: $180,000 to $255,000 </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":360,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"singleLevel"}" data-aria-posinset="39" data-aria-level="1">Denver, CO: $170,000 to $240,000 </li> </ul> <h2>Work Environment</h2> <ul> <li>Work Location: this role will be fully onsite at our facilities in Centennial, CO, or Long Beach, CA  #LI-Onsite</li> <li>This role operates in a fast-paced, high-stakes environment where rapid decision-making and adaptability are essential</li> <li>Bias towards delivery and iteration to discover the right use cases for security investments</li> <li>Must be comfortable taking calculated risks and owning accountability for managing those risks</li> <li>Passionate about solving real-world security problems in resource-constrained embedded environments</li> <li>Collaborative culture with opportunities for significant ownership and technical leadership</li> <li>Direct access to leadership and opportunity to influence spacecraft security architecture</li> </ul> <h2>What We Offer</h2> <ul> <li>Competitive salary</li> <li>Opportunity to work on cutting-edge spacecraft technology and define security standards for next-generation space systems</li> <li>Professional development and certification support</li> <li>Collaborative culture with experienced embedded systems and security professionals</li> <li>Equity + Benefits including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave</li> </ul>   This position will be open until it is successfully filled. To submit your application, please follow the directions below. To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State. True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us know.  <div class="content-conclusion">To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State. True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us know.</div>

About the Role

Related Roles