Hardware Security Consulting Engineer

Job Description

As consulting hardware security engineer, you will be responsible for defining security requirements for hardware used within OCI, conducting security / architectural reviews and assessments, offensive testing for hardware and firmware and mentoring junior engineers

Responsibilities

Job Description

Principal Engineer – Hardware Security

Oracle Cloud (United States)

The Oracle Cloud Infrastructure (OCI) team can provide you the opportunity to build and operate a suite of massive scale, integrated cloud services in a broadly distributed, multi-tenant cloud environment. OCI is committed to providing the best in cloud products that meet the needs of our customers who are tackling some of the world’s biggest challenges.

We offer unique opportunities for smart, hands-on security engineers with the expertise and passion to solve difficult problems in distributed highly available services and virtual infrastructure. At every level, our engineers have a significant technical and business impact designing and building innovative new systems to power our customer’s business critical applications. Our customers run their businesses on our cloud, and our mission is to provide them with the most secure cloud services.

The OCI Hardware Security group conducts Security assessments of the production hardware that runs our cloud, and develops the requirements for future Networking, Storage, Compute components. We work closely across Oracle, with third party vendors, and with standards organization to influence the next generation of hardware platform security. In addition to defining the best hardware, OCI HW Security knows that platform security also depends on how that hardware is used. To that end, HW Security also works closely with OCI's operations and engineering teams, constantly striving to improve Oracle Cloud's overall operational security posture by defining the supply chain and operational requirements to establish best practices for managing security for every device in our data centers.

A security-focused engineer at any level can have significant technical and business impact. Come shape the future of one of the largest clouds on earth with us. Overall, the OCI Security Architecture team performs a variety of work ranging from cloud security, application security, vulnerability analysis, threat modeling, and hacking / enterprise network penetration.

The biggest challenges for the team is the dynamic and fast growth of the business, driving us to improve our systems, tools, and automation to scale to our security expertise several orders of magnitude greater than what we can support today. We understand that software is living and needs investment. The challenge is making the right tradeoffs, communicating those decisions effectively, and crisp execution.

Responsibilities :

Develop and communicate requirements for new vendors and hardware (compute, storage, networking)

Engage with Oracle Hardware Division and third party vendors to understand their roadmaps

Create planning roadmaps to drive multi-year security improvements across the OCI Infrastructure

Review or assess engineering changes, or revisions of, an existing component. E.g. : new firmware for a device, vendor revision of an existing device

Identify and participate in external standards groups to drive improvements across the industry

Consult development teams and third-party vendors in design and architecture of secure systems

Champion and consult on secure development life-cycle practices

Communicate and educate Senior Management on key Security topics and directions

Perform security / architectural / design reviews for security controls in hardware, offensive security assesments for hardware and firmware

Minimum Qualifications

Bachelor's degree in Electrical Engineering, Computer Science or related field or equivalent experience

10+ years of experience in hardware security architecture / engineering / validation / planning or related area

Demonstrated competency in application / product / software / hardware security

Preferred Qualifications

Ability to write clear and concise product security requirements

Ability to effectively assess risk from findings and threat models and identify proper risk mitigation controls

Ability to succeed individually or collaboratively, whether working internally or with external organizations and individuals

Experience working effectively in a large and distributed company

Basic knowledge of x86 and / or ARM server platform architecture

Knowledge of standard UEFI architecture and implementation

Knowledge of modern platform security technologies like TPM 2.0 and TCG SRTM / DRTM

Knowledge of vendor-specific TEE technologies such as Intel SGX

Familiarity with common embedded communications interfaces (SPI, I2C, RS232-style serial)

Ability to read and understand simple schematic diagrams

Basic knowledge of enterprise and / or datacenter networking architecture

Excellent organizational, verbal and written communication skills

Our senior team members possess expertise in the areas listed above in addition to some of the following :

Master's degree in Electrical Engineering, Computer Science or related field or equivalent experience

10+ years of experience in vulnerability discovery / security engineering / hardware security / security product management

Extensive research or experience with multiple classes of security bugs

Specification and / or design of hardware security features

Expert knowledge of x86 and / or ARM server platform architecture

Ability to work with most common programming languages (C, C++, Java, Python, Ruby, Go, Rust)

Ability to read and understand x86 and / or ARM assembly language

Ability to read and understand large and complex platform-level schematics

Knowledge of host and network virtualization technologies and how to use them securely

Significant experience operating in a large-scale DevOps or CICD environment

Conducting training / thought leadership / conference talks / publications

Disclaimer :

Certain US customer or client-facing roles may be required to comply with applicable requirements, such as immunization and occupational health mandates.

Range and benefit information provided in this posting are specific to the stated locations only

US : Hiring Range in USD from : $120,100 to $251,600 per annum. May be eligible for bonus, equity, and compensation deferral.

Oracle maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect Oracle’s differing products, industries and lines of business.

Candidates are typically placed into the range based on the preceding factors as well as internal peer equity.

Oracle US offers a comprehensive benefits package which includes the following :

Medical, dental, and vision insurance, including expert medical opinion

Short term disability and long term disability

Life insurance and AD&D

Supplemental life insurance (Employee / Spouse / Child)

Health care and dependent care Flexible Spending Accounts

Pre-tax commuter and parking benefits

401(k) Savings and Investment Plan with company match

Paid time off : Flexible Vacation is provided to all eligible employees assigned to a salaried (non-overtime eligible) position. Accrued Vacation is provided to all other employees eligible for vacation benefits. For employees working at least 35 hours per week, the vacation accrual rate is 13 days annually for the first three years of employment and 18 days annually for subsequent years of employment. Vacation accrual is prorated for employees working between 20 and 34 hours per week. Employees working fewer than 20 hours per week are not eligible for vacation.

11 paid holidays

Paid sick leave : 72 hours of paid sick leave upon date of hire. Refreshes each calendar year. Unused balance will carry over each year up to a maximum cap of 112 hours.

Paid parental leave

Adoption assistance

Employee Stock Purchase Plan

Financial planning and group legal

Voluntary benefits including auto, homeowner and pet insurance

The role will generally accept applications for at least three calendar days from the posting date or as long as the job remains posted.

Career Level - IC5

About Us

As a world leader in cloud solutions, Oracle uses tomorrow’s technology to tackle today’s challenges. We’ve partnered with industry-leaders in almost every sector—and continue to thrive after 40+ years of change by operating with integrity.

We know that true innovation starts when everyone is empowered to contribute. That’s why we’re committed to growing an inclusive workforce that promotes opportunities for all.

Oracle careers open the door to global opportunities where work-life balance flourishes. We offer competitive benefits based on parity and consistency and support our people with flexible medical, life insurance, and retirement options. We also encourage employees to give back to their communities through our volunteer programs.

We’re committed to including people with disabilities at all stages of the employment process. If you require accessibility assistance or accommodation for a disability at any point, let us know by emailing accommodation-request_mb@oracle.com or by calling +1 888 404 2494 in the United States.

Oracle is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability and protected veterans’ status, or any other characteristic protected by law. Oracle will consider for employment qualified applicants with arrest and conviction records pursuant to applicable law.