Security Engineer - Devices

Security Engineer - Devices

Somana is a generative robotics company. We founded the company because the incredible advances in the modeling layer have no way to access a fragmented physical world. We're building the connective tissue that brings physical AI into the industrial world.

Somana is a hardware, software, and services platform powering rapid improvements in capacity, throughput, yield, and quality. Our compute platform talks to hundreds of peripherals, living on factory floors and has capabilities that compound after every run - which means the mechanical systems that house, cool, protect, and connect them are as critical as the silicon itself.

ROLE OVERVIEW:

Somana builds compute hardware and edge devices in-house for physical AI. We're looking for a senior Security Engineer to own security across the full lifecycle of that hardware — from threat modeling the architecture to deploying and maintaining protections in the field. This will be a highly collaborative role, helping to define longterm goals, and set standards for testing, reliability and compliance.

CORE RESPONSIBILITIES:

• Own the trusted boot chain across our compute generations: signed firmware and bootloaders, vendor secure boot (fusing workflows included), signed kernel and root filesystem verification, and full-disk encryption with automated unlock

• Own signing key management and the infrastructure behind it: HSM-backed signing keys, separation of development and production trust roots, key rotation, and build-time enforcement that the right keys sign the right artifacts

• Define and implement hardening postures for our devices — network exposure, privilege boundaries, and the difference between a locked-down fielded unit at a customer site and a debuggable bench unit in the lab

• Lead threat analysis and security architecture for the compute and edge devices we design and build in-house, deployed in physically accessible industrial and manufacturing environments

• Drive vulnerability management for the fielded fleet: CVE triage against kernel and userspace, patching strategy for deployed hardware, and a clear picture of fleet security state

• Work hands-on with firmware and platform teams to embed security into the development process — secure coding standards, design reviews and regression testing

• Explain security decisions to the engineers who implement them and to the stakeholders who accept the residual risk

• Support supply chain security: component vetting, artifact provenance, and anti-counterfeiting / anti-tamper measures

• Contribute to compliance and certification work as needed (e.g. FIPS 140-3, Common Criteria, NIST frameworks)

REQUIRED SKILLS:

• 4+ years of professional engineering experience with a focus on embedded systems, Linux, and/or established hardware

• Hands-on experience implementing a secure boot chain on real production hardware: code signing, chain of trust, UEFI Secure Boot or related

• Fluency with embedded systems: ARM SoCs, microcontrollers, bootloaders (U-Boot, TF-A), embedded Linux internals (boot flow, systemd, privilege boundaries, device access control), and the firmware build chain

• Proficiency in C or Rust, plus the ability to work fluently in shell

• Practical cryptographic engineering: PKI and certificate hierarchies, HSM or PKCS#11-backed signing, key lifecycle management, and full-disk encryption

• Practical hardening and vulnerability-management experience on real deployed systems

• Track record of taking security features from architecture through board bring-up to volume production

• Ability to work independently as the security owner — this is a founding-level security function, not a seat on a large security org

NICE-TO-HAVES:

• Experience with a specific SoC vendor's secure boot and fusing workflow (NVIDIA Jetson, NXP, Qualcomm, or similar)

• Familiarity with measured boot, TPMs, and remote attestation

• Declarative configuration and reproducible builds — Nix/NixOS is what we're most excited to see; adjacent depth in Bazel, Buildroot, or Yocto is a solid substitute

• Offensive security experience, including hardware attacks: bus sniffing, fault injection, glitching, DPA/SPA, JTAG and boot interruption

• Background securing devices in physically accessible, customer-operated environments (tamper-evident packaging, secure enclosures, physical access threats)

• Experience with confidential computing or secure OS foundations

• Experience with SOC, FIPS 140-3 or Common Criteria certification processes

• Contributions to the security community — CVEs, conference talks or open-source tooling

LOCATION & COMPENSATION:

• San Francisco, CA or SoHo NYC (Onsite)

• Competitive salary + meaningful equity - this is a foundational role on a small team

• Catered lunch, snacks, panoramic views, and pet-friendly office

• Health, Dental, Life, Vision + HSA benefits + 401k