Lead Principal Security Engineer

Oracle is a leading company in cloud solutions and AI, providing innovative products and services. The Lead Principal Security Engineer will ensure that the compute hardware used in Oracle Cloud Infrastructure meets security standards, overseeing security requirements and improving overall operational security posture.

Responsibilities:

• Definition of security requirements for hardware enabling OCI security posture aligning business needs and technology trends
• Provide independent design consulting for complex compute systems, balancing business objective and security risks to implement:
• Requirements specified by the hardware security team
• Features required to achieve security bar
• Operations (provisioning, re-use, decommissioning) inline with security posture
• Hands on
• Security assessments of complex compute systems to ensure they meets requirements
• Adversarial assessments to ensure they can’t be compromised
• Breakdown complex systems for analysis, assign parts to other members of the team, collaborate on synthesizing the inputs and forming a holistic assessment, contextualized to cloud environments
• Understand business objectives/requirements and assess risk from findings/threat models and identify proper risk mitigation controls
• Work across to teams to ensure requirements, findings and recommendations are implemented inline with expected outcomes
• Communicate risks and options to mitigate to senior leadership, balancing security, technology and business goals
• Identify opportunities for security and process improvements and drive them across the organization
• Advance state of the industry security knowledge through individual research contribution
• Follow developments and trends in their area of subject matter expertise and educate the business and security organization of the developments
• Mentor junior engineers

Requirements:

• Bachelor's degree in Electrical Engineering, Computer Science or related field or equivalent experience
• 10+ years of experience in hardware security architecture / engineering / validation / planning or related area
• Demonstrated competency in hardware/firmware with a focus on security
• Competency with computer architecture
• Subject Matter Expertise in two or more of the following areas: Root Of Trust (TCG SRTM, DRTM), x86 (Intel, AMD), ARM server platform architecture, UEFI, GPU platforms, rackscale systems, clustering, Baseboard Management Controllers, SmartNICs (DPUs), Storage devices
• Security concepts and standards associated Attestation (Ex: SPDM), cryptography, Secureboot, DICE etc
• Ability to work with most common programming languages (C, C++, Java, Python, Ruby, Go, Rust)
• Ability to read and review complex hardware system/platform level schematics for security concerns
• Experience with reversing tools and ability to reverse engineer
• Extensive research or experience with multiple classes of security bugs
• Specification and/or design of hardware security features
• Ability to read and understand x86 and/or ARM assembly language
• Knowledge of vendor-specific TEE technologies such as Intel SGX
• Familiarity with common embedded communications interfaces (SPI, I2C, RS232-style serial)
• Knowledge of host and network virtualization technologies and how to use them securely
• Knowledge of enterprise and/or datacenter networking architecture
• Experience operating in a large-scale DevOps or CICD environment
• Ability to write clear and concise product security requirements
• Ability to effectively assess risk from findings and threat models and identify proper risk mitigation controls
• Ability to succeed individually or collaboratively, whether working internally or with external organizations and individuals
• Significant experience working effectively in a large and distributed company
• Excellent organizational, verbal and written communication skills
• Conducting training / thought leadership / conference talks / publications