Senior Security Engineer

Senior Security Engineer (Robotics / IoT / Healthcare Technology)

Location: Bay Area, CA (Hybrid – 3 days/week on-site)

Reports To: Head of Software Engineering

Compensation: $163-213K

About Our Client

Our client builds state-of-the-art autonomous robotics designed to automate prescription dispensing. Their flag-ship hardware and software system operates behind the pharmacy counter, handling stock medication to produce accurately counted, labeled vials so pharmacists and technicians can focus on patient care.

About the Role

As the Senior Security Engineer , you will completely own security engineering for an autonomous physical robot and its entire connected ecosystem: the machine hardware, its embedded operating system image, the software that runs on it, the cloud services that command it, and the secure update pipeline.

When a customer asks how each machine proves its identity, who can reach it, and how independent security testing was resolved, the answer rests entirely on your work—backed by automated evidence produced directly by the system.

What You’ll

Own

• The Threat Model:

Maintain and evolve a written threat model covering all trust boundaries: machine-to-cloud, operator-to-screen, the update path, remote support, and suppliers.

• Design Security Reviews:

Conduct early, recorded security reviews for new feature designs.

• Device Identity & Key Custody:

Partner with OS image engineers to build and verify platform-level device identity and key custody.

• Independent Security Testing:

Run third-party security audits end-to-end (scoping, test environments, triage, squad remediation, and retest evidence).

• Vulnerability Management:

Set rules, track findings, and drive code, dependency, device image, and cloud weaknesses to closure across all engineering squads.

• Incident Response:

Lead the security response (detection, triage, containment, forensics) in close collaboration with SREs and engineering squads.

• Customer Security Reviews:

Vet all customer security questionnaires against real evidence (code, configuration, operational records) before statements are delivered.

• Cloud Posture:

Maintain IAM, secrets management, infrastructure-as-code reviews, and cloud threat detection.

• Security & Privacy Controls:

Verify and collect continuous system evidence for all committed security and privacy controls (including HIPAA compliance).

Your First 90 Days

• Day 30:

You have traced the trust boundaries yourself, taken ownership of the threat model and past test records, and completed your first design review.

• Day 60:

You hold the verification for device identity, key custody, and the secrets inventory. Every customer security statement passes your check first.

• Day 90:

You have scoped and prepared the environment for the next independent security audit and can provide assessors with system-generated control evidence.

What We’re Looking For

Must-Have Qualifications:

• End-to-End Ownership:

You have owned the security of a shipped physical or connected hardware product end-to-end. (Pure consulting or pure compliance experience alone will not fit this role).

• Hands-on Builder:

You actively read and write code. Our client’s stack uses

Rust, TypeScript, and Python

(deep skill in one and comfort reading the others is required). Your design reviews come with precise guidance or working patches.

• Systems & Network Depth:

Expertise in TLS/certificates, IAM, secrets management, and Linux hardening. Ability to reason about trust boundaries from hardware to the cloud.

• Offensive Fluency + Defensive Judgment:

Experience running or partnering with penetration tests, with the ability to pragmatically rank and prioritize real-world risks.

• Pragmatic Threat Modeling:

You prefer eliminating attack surfaces over adding complex controls, and developers actively seek out your guidance.

• Exact Communication:

Ability to communicate technical truths clearly to engineers, executives, and customer assessors alike.

Nice-to-Have Experience:

• Embedded/Device security: Secure boot, hardware-held keys (TPM/HSM), signed firmware updates, fleet identity.
• Security in healthcare, medical devices, or regulated industries (plus supplier-side customer security reviews).
• Cloud security engineering on AWS.
• Supply-chain security: Dependency management, artifact signing, provenance.
• Familiarity with standards like IEC 62443, UL 2900-1, or NISTIR 8259.

Interview Process

1. Recruiter Screen:

30 mins

2. Technical Interview:

90 mins

(Based on a 2–3 hour take-home exercise sent 24 hours prior: hardening a small working system)

3. Design Interview:

60 mins

(Focusing on trust boundaries and key custody)

4. Leadership Interview:

60 mins

(Cross-squad collaboration and ownership)

Why Join Our Client?

• High-Impact Autonomy:

You set the security standard for a high-value robotics platform and report directly to the Head of Software Engineering.

• Cutting-Edge Technical Challenges:

Work across the full stack—from hardware-level device identity and OS images to cloud services and secure update paths.

• Collaborative Culture:

Hybrid working environment in the Bay Area (3 days/week in-office to work directly with physical hardware). High trust, zero bureaucracy.