Note: The job is a remote job and is open to candidates in USA. OKSI is seeking a Product Security Engineer to own product-level security across their hardware and software systems. The role involves defining and maintaining security policies and standards, conducting threat modeling, and ensuring compliance throughout the product lifecycle.
Responsibilities
- Lead threat modeling and security analysis across hardware, firmware, and software throughout the product lifecycle
- Produce threat matrices, risk assessments, and security requirements traceable through design reviews and release gates
- Own CVE tracking, vulnerability management, and security baseline compliance across the product portfolio
- Define and implement hardening standards for embedded Linux, RTOS, and bare-metal environments
- Establish code signing policies, secure boot chain integrity, and validation procedures
- Partner with IT and Engineering to architect and maintain the product signing and key management infrastructure using HSMs, KMS, or equivalent systems
- Own OKSI's anti-tamper posture aligned with DoD policy (DoDI 5200.39) and applicable Program Protection Plan requirements
- Define IP protection strategy spanning software binary protection, hardware design protection, firmware confidentiality, and cryptographically bound license enforcement
- Serve as OKSI's product security authority
- Establish company-wide standards, lead design reviews, provide security sign-off at program milestones, and embed security requirements into the Systems Engineering process
- Provide guidance and training to Engineering, IT, and Operations teams on secure design principles
Skills
- 7+ years of product security, embedded security, or cybersecurity systems engineering in a defense, aerospace, or advanced technology environment
- Demonstrated expertise leading threat modeling, security risk assessments, and vulnerability analysis across hardware, firmware, and software domains — including production of threat matrices, attack surface analyses, and traceable mitigation plans
- Hands-on experience defining and implementing security policies and standards (not just executing implementation tasks). You own the policy and architecture
- Working knowledge of secure boot architectures, anti-tamper techniques, and embedded platform security (e.g., UEFI Secure Boot, ARM TrustZone, fuse-based root-of-trust)
- Practical experience with embedded Linux hardening: kernel configuration, module signing, RBAC/least-privilege access models, debug interface lockdown, and production credential management
- Experience with key management infrastructure and signing pipelines (HSMs, KMS, or equivalent) for firmware, software releases, and factory provisioning workflows
- Familiarity with DoD program protection and anti-tamper policy frameworks (DoDI 5200.39) and experience producing or reviewing Program Protection Plans (PPPs)
- Strong written and verbal communication skills for policy documentation, risk reporting, and cross-functional leadership
- You must have, or be eligible to obtain, a U.S. Department of Defense Secret security clearance. You will be subject to government security investigations and must be able to access classified information. The inability to obtain a security clearance will result in you being ineligible for the position
- Active DoD Secret or Top Secret clearance
- Experience establishing a secure product development lifecycle (SPDLC) or embedding security checkpoints into an engineering development process
- Familiarity with secure CI/CD pipeline design, software supply chain security, and artifact integrity controls
- Background in ITAR/EAR technology protection controls and export-controlled program environments
- Familiarity with CMMC, RMF, IEC 62443, or NIST SP 800-193/800-147 frameworks
- Experience with EO/IR, UAS, autonomous systems, or other embedded defense technology programs
- Relevant certifications: CISSP, CSSLP, CEH, or equivalent
- DoD SkillBridge participants with relevant MOS/AFSC experience (e.g., 17A, 25D, 1B4, or program protection/acquisition roles) are strongly encouraged to apply
Benefits
- Medical, dental, and vision coverage fully paid by the employer for employees
- Three weeks of vacation to start
- Automatic company contribution to 401K – 5% of earned wages (no matching required)
- Educational assistance and professional development opportunities
- In-office (Jacksonville, AK or Los Angeles, CA) or remote work (United States) available (position dependent)
Company Overview