Software Engineer, HSM Infrastructure Security, Consumer Devices
About this role
Defending device ecosystems against compromise requires hardening the boundary between policy systems and the hardware security modules protecting sensitive cryptographic keys. OpenAI needs a security software engineer to design and implement the hardware-backed security foundations used across its consumer devices. This practitioner will develop security-critical software and firmware within or adjacent to an HSM trust boundary, building the interface responsible for authorizing certificate issuance and cryptographic signing operations.
Daily responsibilities involve hands-on system design, writing and reviewing production code, and debugging across hardware and software boundaries from initial requirements through deployment. Ideal candidates bring deep programming experience in systems software, a strong background in applied cryptography, and comfort working in resource-constrained environments. This position focuses heavily on engineering implementation rather than administrative compliance or architecture-only planning.
What you will do
- Design and implement security-critical software and firmware for hardware security modules, secure elements, and trusted execution environments.
- Build and harden the policy-to-HSM boundary responsible for authorizing certificate issuance and cryptographic signing operations.
- Implement or extend cryptographic interfaces such as PKCS#11, OpenSSL providers or engines, and platform key-storage APIs.
- Design and implement HSM-backed certificate authority, code-signing, key-management, and device-identity systems.
- Write, review, test, and audit secure embedded software for resource-constrained environments.
- Develop test harnesses, emulators, fuzzers, and fault-injection tooling to validate security properties and failure behavior.
- Threat-model hardware and software trust boundaries and translate findings into concrete engineering improvements.
What you need
- Minimum of five years of experience building secure embedded firmware for constrained environments.
- Deep programming experience in C, C++, or Rust.
- Demonstrated track record of designing, implementing, debugging, and shipping production systems software.
- Hands-on experience developing security-critical software or firmware within or directly adjacent to an HSM, secure element, TEE, or hardware root of trust.
- Strong knowledge of applied cryptography, digital signatures, key hierarchies, secure key management, and cryptographic protocol design.
Nice to have
- Firmware development for ARM TrustZone or another trusted execution environment.
- Experience with commercial or cloud HSM platforms such as Thales Luna, Entrust/nShield, Utimaco, Marvell LiquidSecurity, or AWS CloudHSM.
- Device manufacturing, secure provisioning, factory restore, or silicon bring-up experience.
- Multi-party authorization, quorum-controlled deployments, tamper-resistant audit mechanisms, or attestable policy systems.
Benefits
- Offers Equity
Skills and tech stack
Questions candidates ask
What is the compensation range for this role?
The salary range for this position is $347K – $445K and includes offers of equity.
Where is the position located?
This role is located in San Francisco.
Is this an architecture-only or administrative job?
This is a hands-on software-engineering role where you will design systems, write and review production code, debug across hardware and software boundaries, and carry projects from initial requirements through deployment. It is not an HSM administration, PKI operations, compliance, or architecture-only position.