SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
OpenAI is hiring a Security Software Engineer to design and implement hardware-backed security foundations across its device ecosystem. This is a hands-on, production-focused role centered on hardening the boundary between policy systems and HSMs (Hardware Security Modules) that protect sensitive cryptographic keys.
You will develop security-critical software and firmware within or adjacent to HSM trust boundaries. Depending on your background, this may include HSM trusted applications, firmware services, cryptographic mechanisms, device drivers, PKCS#11 components, secure-provisioning protocols, or signing-policy enforcement systems.
Key responsibilities include:
- Design and implement security-critical software and firmware for HSMs, secure elements, trusted execution environments, and hardware roots of trust
- Build and harden the policy-to-HSM boundary responsible for authorizing certificate issuance and cryptographic signing operations
- Develop HSM trusted applications, firmware components, host interfaces, device drivers, SDKs, or cryptographic service integrations
- Implement or extend cryptographic interfaces such as PKCS#11, OpenSSL providers/engines, or platform key-storage APIs
- Build firmware and software that cryptographically enforces key generation, provisioning, usage, rotation, recovery, and destruction policies
- Design and implement HSM-backed certificate authority, code-signing, key-management, and device-identity systems
- Develop end-to-end cryptographic protocols spanning devices, secure hardware, policy services, and backend infrastructure
- Build security capabilities supporting device attestation, secure boot, factory provisioning, user registration, and authentication
- Design controls making trusted software and policy changes verifiable, auditable, and subject to multi-party authorization
- Write, review, test, and audit secure embedded software for resource-constrained environments
- Develop test harnesses, emulators, fuzzers, and fault-injection tooling to validate security properties
- Threat-model hardware and software trust boundaries and translate findings into engineering improvements
- Partner with hardware, firmware, infrastructure, application, and security teams to integrate secure-by-default capabilities
- Help establish engineering standards for HSM development, applied cryptography, secure key management, and certificate infrastructure
This is not an HSM administration, PKI operations, compliance, or architecture-only position. You will design systems, write and review production code, debug across hardware and software boundaries, and carry projects from initial requirements through deployment.
QUALIFICATIONS:
Minimum:
- 5+ years experience building secure embedded firmware for constrained environments
- Deep programming experience in C, C++, or Rust
Highly Desired:
- Strong track record of designing, implementing, debugging, and shipping production systems software
- Hands-on experience developing security-critical software or firmware within or directly adjacent to an HSM, secure element, TEE, or hardware root of trust
- Experience developing HSM firmware, trusted applications, cryptographic mechanisms, hardware-accelerated cryptographic services, HSM device drivers, host libraries, SDKs, middleware, PKCS#11 providers, secure key-provisioning protocols, HSM-backed certificate authority or code-signing systems, or signing-policy enforcement within hardware-backed trust boundaries
- Strong knowledge of applied cryptography, digital signatures, key hierarchies, secure key management, and cryptographic protocol design
- Experience with PKI, X.509 certificates, certificate authorities, certificate issuance, and certificate lifecycle protocols
- Familiarity with secure boot, measured boot, device identity, remote attestation, or hardware-backed storage
- Experience reasoning about concurrency, memory safety, privilege separation, hardware interfaces, failure modes, and side-channel or physical attack considerations
- Ability to evaluate security designs and personally implement the software required to realize them
- Clear communication skills and ability to collaborate across hardware, firmware, backend, and product teams
Additional Experience That May Help:
- Firmware development for ARM TrustZone or another trusted execution environment
- Experience with commercial or cloud HSM platforms (Thales Luna, Entrust/nShield, Utimaco, Marvell LiquidSecurity, AWS CloudHSM, or comparable systems)
- Experience with PKCS#11, KMIP, OpenSSL providers/engines, secure-element APIs, or platform-native key-storage frameworks
- Device manufacturing, secure provisioning, factory restore, or silicon bring-up experience
- Secure boot ROM, bootloader, firmware-signing, anti-rollback, or authenticated-update development
- Developing trusted applications or cryptographic services inside an HSM or secure coprocessor
- Hardware/software co-design involving cryptographic accelerators, secure processors, or custom silicon
- Multi-party authorization, quorum-controlled deployments, tamper-resistant audit mechanisms, or attestable policy systems
- Secure or private storage systems based on hardware-protected keys
- Experience sustaining high-assurance security software in production
