Security and Confidential Computing Architect

Rosaic Labs, Santa Clara, CA +3

Core Resposibilities

Own the SoC threat model, security specification, trust boundaries, and key hierarchy across compute and I/O dies, memory, interconnects, host interfaces, and network links.
Define the root-of-trust architecture, secure and measured boot, firmware measurement, fuse policy, and lifecycle states for platform, power-management, and dispatch firmware.
Specify device, host, and trust-domain attestation, including the relevant SPDM, PCIe DOE, and MCTP interfaces.
Architect confidential I/O and DMA isolation across PCIe and CXL, including IDE, TDISP, device-MMU and System-MMU ownership checks, and trust-domain integration.
Define memory encryption and integrity requirements, including HBM protection, per-trust-domain keys, crypto-engine needs, and effects on memory throughput and migration.

Rosaic Labs, Santa Clara, CA +3

$250K–$300K

a year

This base pay is above the median for security engineering jobs in the Bay Area with no level in the job title.

We compare the middle of each posted range. This is base pay as posted. The group does not include this job.

Location: Santa Clara, CA +3
Work type: Hybrid
Level: Not given
Experience: 12+ years
Posted: 22 days ago
Last check: 14 h ago
Job type: Security engineering
Visa sponsorship: The job text says that the company can sponsor a visa. Confirm this with the company.

The Rosaic Labs site opens in a new tab.

No one has reported an interview at Rosaic Labs yet. Did you interview there? Add the questions.

Compare your résumé with this job. See where you match, what is missing and which lines to change.

Own the SoC threat model, security specification, trust boundaries, and key hierarchy across compute and I/O dies, memory, interconnects, host interfaces, and network links.
Define the root-of-trust architecture, secure and measured boot, firmware measurement, fuse policy, and lifecycle states for platform, power-management, and dispatch firmware.
Specify device, host, and trust-domain attestation, including the relevant SPDM, PCIe DOE, and MCTP interfaces.
Architect confidential I/O and DMA isolation across PCIe and CXL, including IDE, TDISP, device-MMU and System-MMU ownership checks, and trust-domain integration.
Define memory encryption and integrity requirements, including HBM protection, per-trust-domain keys, crypto-engine needs, and effects on memory throughput and migration.