Advanced Engineer - Application Security

Overview

Security Engineer on the Global KMS team, contributing to the development and operation of foundational security services, including secure device provisioning, lifecycle management, and SOC-integrated Root of Trust (RoT) capabilities that support Trusted Execution Environments (TEEs) and other trusted platform components.

What you'll do

• Collaborate closely with product engineering, IT, and manufacturing teams to embed security proactively throughout the product development lifecycle.
• Design, develop, deploy, and operate security infrastructure services, including Key Management Systems (KMS), manufacturing provisioning services, Certificate Authorities (CA), and code-signing infrastructure.
• Define and implement APIs, protocols, and services for the secure enumeration, configuration, and management of platform assets.
• Develop and maintain policies, procedures, and controls for cryptographic key generation, handling, lifecycle management, and access governance.
• Interface with manufacturing partners to support, troubleshoot, and resolve security provisioning issues.
• Partner with software development teams to enable hosting platforms, tooling, SDKs, and integration components for internal and external consumers.
• Own the day-to-day operation, reliability, and continuous improvement of security infrastructure services.

What you'll need

• 5+ years of industry experience in a security engineering role.
• Strong working knowledge of Linux environments, including command-line tools.
• Proficiency in C/C++, Java, and Python.
• Practical experience with HTTP(S) services, including reverse proxies (Apache or Nginx), VPNs, and SSL/TLS configuration.
• Foundational experience with Hardware Security Modules (HSMs), including PKCS#11 (Cryptoki) interface usage, code-signing services, secure payload decryption, certificate signing, and device identity generation.
• Ability to understand complex systems, particularly within vehicle architectures and manufacturing workflows.
• Strong understanding of security concepts, including secure key generation and delivery, access control mechanisms and token-based authorization, multi-party authorization (e.g., n-of-m approval schemes), and cryptographic primitives and secure communication protocols.

Nice to have

• Bachelor's or Master's degree in Computer Science, Engineering, Mathematics, or a related field.
• Excellent verbal and written communication skills in English.
• Strong collaboration skills, openness in communication, resilience, and a high sense of ownership.
• Automotive cybersecurity experience, ideally within a Tier-1 supplier or OEM environment.
• Hands-on experience with HSM deployment, maintenance, backup, and recovery; code-signing infrastructure and access control systems; web services deployment and CI/CD pipelines.
• Experience with containerized and cloud-native technologies such as Docker, Kubernetes, and Amazon ECS.
• Familiarity with CloudHSM technologies.
• Experience with Utimaco HSMs, including firmware configuration and management.
• Experience with logging, monitoring, and observability tools such as rsyslog, Logstash, and the ELK Stack.
• Knowledge of Linux system hardening and access control technologies, including SELinux, AppArmor, SMACK, PAM, SSH, and FIDO/U2F.
• Key provisioning experience for Trusted Execution Environments (TEEs), such as Trustonic/Kinibi.
• Practical experience with Microsoft SignTool, AUTOSAR (SHE), and Android APK/APEX signing processes.

Details

• Location: Bangalore, India (office-hybrid setup); the ATS location line lists Pune, Maharashtra, India.
• Work mode: hybrid, with most office-based roles onsite three days a week.
• Willing to travel up to 5%, both domestically and internationally.