Security and Confidential Computing Architect

Core Resposibilities

• Own the SoC threat model, security specification, trust boundaries, and key hierarchy across compute and I/O dies, memory, interconnects, host interfaces, and network links.
• Define the root-of-trust architecture, secure and measured boot, firmware measurement, fuse policy, and lifecycle states for platform, power-management, and dispatch firmware.
• Specify device, host, and trust-domain attestation, including the relevant SPDM, PCIe DOE, and MCTP interfaces.
• Architect confidential I/O and DMA isolation across PCIe and CXL, including IDE, TDISP, device-MMU and System-MMU ownership checks, and trust-domain integration.
• Define memory encryption and integrity requirements, including HBM protection, per-trust-domain keys, crypto-engine needs, and effects on memory throughput and migration.
• Define security boundaries for cross-die and network communication, including peer authentication, link protection, and key handling with the interconnect and network architects.
• Set authenticated debug-unlock levels, secret-clearing rules, and authorization requirements for in-field test patterns.
• Establish security acceptance and validation criteria, including fault and glitch scenarios, isolation failures, and attestation flows.
• Coordinate implementation with RoT firmware, boot, memory, I/O, DFT, verification, and host software teams.
  
  
  

Minimum Education And Experience

• Bachelor’s degree in Electrical Engineering, Computer Engineering, Computer Science, or a related technical field, or equivalent practical experience.
• At least 12 years of experience in SoC architecture or design, hardware security, or platform security, including at least 3 years defining security architecture across hardware and firmware or software.
• Experience taking a hardware-rooted security feature from threat model and architecture specification through design and verification to silicon bring-up or production deployment.
• Practical experience in at least two of these areas: root of trust, secure boot and attestation; confidential computing and memory protection; trusted I/O and DMA isolation; or secure debug and device lifecycle.
• Experience writing technical specifications and resolving security tradeoffs with RTL, verification, firmware, and software teams.
• Ability to drive the microarchitecture of security-related logic blocks, translating system requirements into implementable interfaces, state machines, access controls, and verification criteria.
  
  
  

Eligibility

In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire. Visa sponsorship is available for this role for qualified candidates.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.