Sr. Staff Firmware Engineer (Secure Boot & OTA implementation)
- Compensation
- $189.2K–$266.8K / yr
- Location
- Sunnyvale, United States
- Work setup
- Not specified
- Seniority
- Staff
- Employment
- Not specified
- Experience
- 15+ years
- Category
- Embedded
- Posted
Skills
Must have
- Tenure: 15+ years of firmware engineering; expert-level C for bare-metal and RTOS targets.
- Bootloader Authorship: Have personally written and shipped a bootloader on a Cortex-M or automotive MCU (S32K, AURIX/TriCore, RH850, STM32-class): the flash drivers, linker scripts, startup code and m
- Verified Boot & A/B: Have integrated cryptographic verification into a boot or update path — signature verification through an HSM/secure element or a crypto library, key handling, anti-rollback — and
- On-Target Update Agent: Have built or substantially owned a software-update agent for constrained embedded devices (vehicle strongly preferred): flash management, resumable transfer, verify-before-act
- Certification Evidence: ISO 26262 (or DO-178C / IEC 61508) work products as an author: MISRA C compliance, static analysis to zero deviations, requirements-based testing with structural coverage (MC/D
- Bench Fluency: JTAG/SWD, logic analyzer, oscilloscope; reads schematics; works from the reference manual at register level.
Nice to have
- Silicon: NXP S32K3 with HSE_B (key catalogs, secure boot, A/B swap); FS26-class safety SBC integration.
- Open-Source Fingerprints: Uptane / TUF / aktualizr / MCUboot / SUIT — contributor rather than user.
- Delta Technology: bsdiff-class delta tooling and compression-aware flash budgeting on MCUs.
- Toolchain: Safety-certified RTOS (PX5, SafeRTOS or similar) and hermetic build systems (Bazel).
- Diagnostics: UDS (ISO 14229) security access and reprogramming services ($27/$29, $34/$36/$37).
- Networking & Middleware: Embedded pub/sub middleware (Zenoh / zenoh-pico, DDS) and automotive Ethernet (100BASE-T1, 10BASE-T1S).
- Hardening: Fault-injection or side-channel countermeasure experience in a boot path.
- Assessor Exposure: Direct interaction with certification bodies (TÜV, exida, UL) during assessment.
- Education: MS or PhD in Computer Engineering, Electrical Engineering or a related field.
Full description
We are looking for the best
About Us
42dot is a mobility AI company committed to solving mobility challenges with software and AI. As the Global Software Center of Hyundai Motor Group, 42dot pioneers the future of mobility by advancing the development of software-defined vehicles.
We develop safety-first, user-centric software-defined vehicle technologies that deliver the latest performance through continuous updates like smartphones. By advancing software and AI technology, 42dot envisions a world where everything is connected and moves autonomously through a self-managing urban transportation operating system.
About the Role
As a Sr. Staff Firmware Engineer, you will build the two components everything else on the platform depends on: the multi-stage secure boot chain and the Uptane update client. The platform is a greenfield, ASIL-D safety firmware platform (ISO 26262 Safety Element out of Context) for a microzonal vehicle E/E architecture, running on NXP S32K3-class lockstep MCUs with a hardware security engine. JTAG is used once per board — to bring up the silicon and flash the immutable bootloader — and every deployment after that, including continuous integration, goes through Uptane. Until your code works, nothing ships; once it works, every engineer on the program runs it daily.
You implement to a security architecture owned by the platform's Firmware Security Architect and to the platform's ASIL-D rules: MISRA C, zero-deviation static analysis, static memory, requirements-based test with MC/DC coverage, and full traceability. Requirement sets for the immutable bootloader, the mutable bootloader and the update client already exist; you inherit, complete and implement them. You are the hands — and you are expected to push back when the hardware or the timing says the architecture is wrong.
Responsibilities
- Secure Boot-Chain Implementation: Write and own the multi-stage boot sequence on the target MCU — startup code, linker command files and memory maps, flash drivers, hardware security engine integration (key catalogs, secure-boot configuration, signature-verification services), anti-rollback counters in HSE-protected storage or OTP, and recovery and fail-safe boot — with boot time measured against budget.
- Fail-Safe A/B Update Layouts: Implement atomic A/B firmware-slot and dual-bank schemes: the low-level state machines for partition switching, background flashing, verify-before-activate and automatic runtime fallback.
- Uptane Client: Implement the on-device update client — metadata parsing and signature/threshold verification across the Root, Timestamp, Snapshot and Targets roles in constrained, statically allocated C; image transfer from the Primary over the platform's Ethernet middleware; staging to flash; the install → verify → activate → confirm/rollback state machine; delta application; and ECU version reporting — as an ASIL-D mandatory application under the platform's lifecycle manager. [SCOPE DECISION: the partial-verification Secondary is core scope; include the full-verification Primary client on the vehicle's central compute only if it stays in this team.]