# Senior Platform Engineer, Embedded Linux & Security at Swan

Swan · San Francisco, on-site · $175k–$250k

Posted 10 Nov 2026 · Still open at our check on 14 Nov 2026

## At a glance

- Role: Security · Senior
- Where you work: San Francisco, United States · in the office
- Pay: $175k–$250k, as stated
- Skills: Linux security, embedded Linux, Linux, Hardening (core); Access control, Provisioning, Identity and access, Authentication, Threat modeling, Authorization, Containers, Cloud security, Vulnerability management, CI/CD, Tls, Over the air, Firmware, Penetration testing, Sandboxing, Firewall, Mtls
- Help me apply: https://roleford.com/signin?job=b8ff05211714fb8774cd828f6e939a52d2023436&from=%2Fjob%2Fsenior-platform-engineer-embedded-linux-security-swan-b8ff05211714

## The job, as Swan posted it

The full text from the original posting, checked 14 Nov 2026.

### Senior Platform Engineer, Embedded Linux & Security

### About the role

This role secures embedded Linux devices and the infrastructure behind them, from boot and provisioning through release, deployment, and cloud services. You'll join a small engineering team as a senior individual contributor, working across device security, DevOps, and backend development.

### What you'll do

- Work with and improve secure device provisioning and hardware-backed security, including fusing, signing, device identity, secure boot, attestation, and disk encryption.
- Help define and harden software release processes from source to device.
- Help design device authentication and authorization services.
- Harden device images and container runtimes, including mandatory access control such as AppArmor or SELinux.
- Run services with least privilege: systemd sandboxing, non-root accounts, and correct file ownership and permissions.
- Set SSH and firewall policy, and close debug paths such as UART, JTAG, and USB recovery.
- Secure web services on devices and in the cloud with TLS and mTLS, reverse proxies, and least-privilege service accounts.
- Threat model the platform, help scope pentests, and track vulnerabilities.
- Plan security for partner engagements and third-party integrations: define requirements, review interfaces and data flows, and set access boundaries.
- Help shape fleet management and over-the-air update approaches, from device enrollment through deployment.
- Build cloud pipelines for device data and identity, with least-privilege access scoped to each device.
- Contribute to arm64 build and image pipelines, including cross-compilation, QEMU-based builds and tests, multi-arch containers, and rootfs customization.
- Write and maintain backend code for device and infrastructure tooling.

### What you bring

- 6+ years of experience across Linux systems, security, and infrastructure engineering.
- Strong working knowledge of hardware-backed security: secure boot chains, fused keys, TPMs and firmware TPMs, TEEs, attestation, and sealed storage.
- Hands-on experience hardening Linux devices, containers, and services, with fluency in permissions, capabilities, and systemd.
- Current knowledge of how to secure edge and IoT devices, such as A/B partitions, read-only root filesystems, and verified boot.
- Confidence building and securing cloud infrastructure and CI/CD pipelines.
- Solid coding skills for tooling and backend services, and the ability to review code for security issues.
- Experience threat modeling systems and working with penetration testers or red teams.
- A bias toward action: delivering on priorities with urgency, and proactively finding, raising, and fixing issues with the team along the way.

### Nice to have

- Hands-on implementation of secure boot, key fusing, or attestation on embedded hardware
- Hands-on implementation of secure OTA updates, including fleet update tools such as Mender
- ML model security on edge devices: current risks and mitigations
- Embedded pentesting or red team work: UART and JTAG access, firmware extraction, rollback and recovery-mode attacks
- Cloud security depth: serverless, IAM policy design, key management, device identity
- Infrastructure as code with tools such as Terraform or Ansible
- C++, Python
- Experience in defense, export-controlled, or CMMC-regulated environments
- Experience in a small, fast-paced startup environment
- Familiarity with corporate security and IT infrastructure

Roleford is not the employer and doesn't take part in hiring decisions.

## Similar jobs

- [Senior Cyber Security Engineer (Splunk) ZT at Pt78](https://roleford.com/job/senior-cyber-security-engineer-splunk-zt-pt78-92f441cd0431): Tampa, on-site · $140k–$155k · 11 Nov
- [Senior Software Engineer - Cloud & Platform Security at ATOMS Careers page](https://roleford.com/job/senior-software-engineer-cloud-platform-security-atoms-careers-page-61de1ea3cb7c): San Francisco, on-site · $167k–$230k · 11 Nov
- [Principal Security & Privacy Compliance Architect at ZScaler](https://roleford.com/job/principal-security-privacy-compliance-architect-zscaler-883743b1a502): Santa Clara, on-site · $196k–$245k · 11 Nov
- [Staff Infrastructure Security Engineer at Ridgeline](https://roleford.com/job/staff-infrastructure-security-engineer-ridgeline-6b0d910326a8): Reno, on-site · $186k–$256k · 11 Nov
- [Systems & IAM Engineer at Finquery](https://roleford.com/job/systems-iam-engineer-finquery-6b2077ac473c): Atlanta, on-site · $110k–$135k · 11 Nov

## Reusing this page

The job text belongs to Swan. Roleford's parts (At a glance, similar jobs) may be quoted with a visible link to https://roleford.com/job/senior-platform-engineer-embedded-linux-security-swan-b8ff05211714. Rules: https://roleford.com/reuse