At a glance
- Employment
- Full-time
- Workplace
- Onsite
- Location
- Austin, TX
About the role
- You'll own the end-to-end security of the fleet and how it interacts with the world.
- This is a generalist role: you'll go wherever the risk is highest, across software, firmware, hardware, and cloud.
Responsibilities
- Own threat modeling and design review across the product, from gateway SoCs and boot chains through embedded firmware, fleet transport, command authority, and cloud services
- Turn threat models into prioritized security objectives and drive their implementation
- Design and build the security foundations under the fleet: device identity and factory provisioning, code and OTA signing, service authentication, and certificate lifecycle across devices that outlive the systems issuing them
- Analyze vulnerability reports and internal findings: reproduce them, run variant analysis, determine exploitability and design impact, and set the direction of the fix
- Test our product the way an attacker would, at whichever layer matters, then turn findings into requirements and standards changes
- Author security engineering standards and reference patterns, build the tooling that makes review and enforcement repeatable
- Produce the technical assessments Base's position rests on in utility, interconnection, and certification engagements where device security is in scope
Requirements
- Experience securing production systems that span multiple trust boundaries
- A track record of shipping security work end-to-end and collaborating across teams to make it stick
- The judgment to distinguish plausible attacks from consequential ones and prioritize accordingly
- The ability to get productive quickly in unfamiliar systems, bottom out assumptions, and support conclusions with evidence
- Enough software engineering depth to read, test, and change the systems you review, regardless of language or tech-stack
- Clear communication and writing skills - ability to rally other teams
