Sr. Staff Firmware Engineer (Secure Boot & OTA implementation)

42dot, Sunnyvale

The role

As a Sr. Staff Firmware Engineer, you will build the two components everything else on the platform depends on: the multi-stage secure boot chain and the Uptane update client. The platform is a greenfield, ASIL-D safety firmware platform (ISO 26262 Safety Element out of Context) for a microzonal vehicle E/E architecture, running on NXP S32K3-class lockstep MCUs with a hardware security engine. JTAG is used once per board — to bring up the silicon and flash the immutable bootloader — and every deployment after that, including continuous integration, goes through Uptane.

Until your code works, nothing ships; once it works, every engineer on the program runs it daily.

All jobs

Sr. Staff Firmware Engineer (Secure Boot & OTA implementation)

42dot, Sunnyvale

The role

Until your code works, nothing ships; once it works, every engineer on the program runs it daily.

What you will do

Secure Boot-Chain Implementation: Write and own the multi-stage boot sequence on the target MCU — startup code, linker command files and memory maps, flash drivers, hardware security engine integration (key catalogs, secure-boot configuration, signature-verification services), anti-rollback counters in HSE-protected storage or OTP, and recovery and fail-safe boot — with boot time measured against budget.
Fail-Safe A/B Update Layouts: Implement atomic A/B firmware-slot and dual-bank schemes: the low-level state machines for partition switching, background flashing, verify-before-activate and automatic runtime fallback.
Uptane Client: Implement the on-device update client — metadata parsing and signature/threshold verification across the Root, Timestamp, Snapshot and Targets roles in constrained, statically allocated C; image transfer from the Primary over the platform's Ethernet middleware; staging to flash; the install → verify → activate → confirm/rollback state machine; delta application; and ECU version reporting — as an ASIL-D mandatory application under the platform's lifecycle manager. [SCOPE DECISION: the partial-verification Secondary is core scope; include the full-verification Primary client on the vehicle's central compute only if it stays in this team.]
Hardware-Enforced Isolation: Configure resource-domain controllers (NXP XRDC-class domain IDs, MDAC, PAC) and core MPUs across boot stages and the handoff to the application, to the isolation policy set by the Security Architect, and validate the resulting memory protections and security states in the lab.
Bandwidth & Storage Optimization: Implement delta application and compression-aware flash budgeting on embedded MCU flash to minimize bus bandwidth and program/erase cycles.
Diagnostic Reprogramming: Implement the diagnostic reprogramming entry (security access, transfer services) where OEM service processes require it, on the platform's transport, without importing an AUTOSAR diagnostic stack.
Defensive Engineering: Harden the verification path against voltage and clock glitching, fault injection and side channels — redundant checks, constant-time comparisons, fail-closed defaults — and feed findings back into the threat model.
Deterministic Firmware Development: Write high-performance, deterministic embedded C for bare-metal and RTOS targets with freedom from interference, using Python exclusively for host-side tooling such as secure payload wrapping and test automation.
Certification Evidence: Produce the ISO 26262 work products for your components: requirements and design in the traceability system, unit and integration tests with structural coverage, static-analysis results, WCET and boot-timing evidence, and freedom-from-interference analysis between bootloader stages and the application.
Low-Level Hardware Integration: Lead bring-up on bench EVKs and production silicon with JTAG/SWD debuggers, logic analyzers and oscilloscopes; integrate the boot chain with the safety SBC's watchdog and safe-state behavior; and make the Uptane path the deployment mechanism for the platform's hermetic CI.
Engineering Leadership: Set the implementation pattern others follow, review the work of engineers who later join the boot/OTA area, and own the bench when it breaks.

Sr. Staff Firmware Engineer (Secure Boot & OTA implementation)

The role

Sr. Staff Firmware Engineer (Secure Boot & OTA implementation)

The role

What you will do

What you need

Nice to have

Interview Process

Additional Information

Pay and benefits

About 42dot

Similar jobs at other companies

Staff Firmware Engineer, Platform Security

Senior Staff Software Engineer - Secure Manufacturing

Sr. Staff Embedded Software Engineer - Security

Senior System Software Engineer - CPU SoC Boot Firmware

Senior Embedded Platform Engineer

Senior Embedded Linux Engineer

42dot

Compared with similar jobs