Lead Principal Security Engineer

Oracle is seeking a Lead Principal Security Engineer to strengthen the security posture of OCI by focusing on consulting hardware security across complex compute systems. This role helps define what secure hardware must deliver, evaluates those systems through security and adversarial assessments, and influences next-generation hardware platform security with partners and standards organizations.

Responsibilities

• Define hardware security requirements that align business needs and technology trends with the OCI security posture
• Provide independent design consulting for complex compute systems to balance business objectives and security risks, implementing requirements specified by the hardware security team
• Provide independent design consulting to implement features required to achieve security bar targets
• Provide independent design consulting to ensure security posture alignment for operations including provisioning, re-use, and decommissioning
• Perform security assessments of complex compute systems to confirm they meet stated requirements
• Conduct adversarial assessments to validate systems cannot be compromised
• Break down complex systems for analysis, assign parts to other team members, and collaborate on synthesizing inputs into a holistic assessment contextualized to cloud environments
• Understand business objectives and requirements, assess risk from findings and threat models, and identify appropriate risk mitigation controls
• Coordinate across teams so requirements, findings, and recommendations are implemented inline with expected outcomes
• Communicate risks and mitigation options to senior leadership while balancing security, technology, and business goals
• Identify opportunities for security and process improvements and drive them across the organization
• Contribute research to advance state-of-industry security knowledge and keep the business and security organization informed about relevant developments
• Mentor junior engineers

Requirements

• Bachelor’s degree in Electrical Engineering, Computer Science, or a related field (or equivalent experience)
• 10+ years of experience in hardware security architecture, engineering, validation, planning, or a related area
• Demonstrated competency in hardware/firmware with a security focus
• Competency with computer architecture
• Subject Matter Expertise in two or more of the following: Root Of Trust (TCG SRTM, DRTM); x86 (Intel, AMD); ARM server platform architecture, UEFI; GPU platforms, rackscale systems, clustering; Baseboard Management Controllers; SmartNICs (DPUs); Storage devices
• Security concepts and standards related to Attestation (example: SPDM), cryptography, Secureboot, DICE, etc.
• Ability to work with most common programming languages: C, C++, Java, Python, Ruby, Go, Rust
• Ability to read and review complex hardware system/platform level schematics for security concerns
• Experience using reversing tools and the ability to reverse engineer
• Extensive research or experience with multiple classes of security bugs
• Experience in specifying and/or designing hardware security features

Location

Nashville, TN (onsite)

Technologies

• TCG SRTM, DRTM; x86; Intel; AMD
• ARM server platform architecture; UEFI
• GPU platforms; rackscale systems; clustering
• Baseboard Management Controllers
• SmartNICs (DPUs); Storage devices
• Attestation; SPDM; cryptography; Secureboot; DICE
• C, C++, Java, Python, Ruby, Go, Rust
• Intel SGX; SPI; I2C; RS232-style serial

Preferred Qualifications

• Ability to read and understand x86 and/or ARM assembly language
• Knowledge of vendor-specific TEE technologies such as Intel SGX
• Familiarity with common embedded communications interfaces including SPI, I2C, RS232-style serial
• Knowledge of host and network virtualization technologies and how to use them securely
• Knowledge of enterprise and/or datacenter networking architecture
• Experience operating in a large-scale DevOps or CICD environment
• Ability to write clear and concise product security requirements
• Ability to assess risk from findings and threat models and identify proper risk mitigation controls
• Ability to succeed individually or collaboratively, including with external organizations and individuals
• Significant experience working effectively in a large and distributed company
• Excellent organizational skills, along with verbal and written communication skills
• Experience conducting training, thought leadership, conference talks, and publications