Security Certification Engineer - Android, Common Criteria & FIPS 140-3

Samsung Research America is hiring a Security Certification Engineer to certify Samsung mobile devices and file encryption products under Common Criteria (NIAP) and FIPS 140-3 standards. The role performs hands-on security engineering, certification testing and documentation, vulnerability analysis, and coordination with global teams.

Responsibilities:

• Security Engineering: This position requires working knowledge of the Android Framework, Linux kernel security, some level of ability to perform code level analysis of the Android Framework, ability to trace and debug security controls across the Android OS Framework (AOSP), BoringSSL/OpenSSL, Keystore, StrongBox/TEE, SELinux policies, and native C/C++ cryptographic libraries. Ability to Perform source code and protocol level analysis to ensure compliance to the specifications
• Common Criteria (NIAP): Drive hands on evaluations against Mobile Device Fundamentals Protection Profile (MDFPP), Application Software PP (App PP), Functional Package for TLS (PKG_TLS), and VPN Client (MOD_VPNC). Assist in the development and review of all test reports and required certification documentation for all the Common Criteria evaluations and FIPS 140-2/3 accreditation
• Technical Documentation Authorship: Independently author, draft, update evaluate all documentation artifacts, for CC specifically Security Targets (ST), Key Management Descriptions (KMD), Entropy Documentation and Administrative/Operational User Guidance (AGD). FIPS 140-3 evaluations draft all the complete Security Policies, create JSON vectors for the cryptographic modules. Develop mitigation strategies to address vulnerabilities uncovered during security testing; and assist with completing all the required documentation to meet the specifications and certification requirements, as required
• Perf FIPS 140-3 Cryptographic Module Validation: Execute every technical step of NIST CMVP/CAVP certification (ISO/IEC 19790). Draft the complete FIPS 140-3 Security Policies, configure and run Automated Cryptographic Validation Protocol (ACVP) JSON test harnesses, validate algorithm implementations (CAVP), support and resolve all the lab testing issues and address CMVP feedback. Perform vulnerability analysis of product or system designs against applicable security criteria using common tools, including Nessus, NMAP, and Wireshark
• Cross Functional & Offshore Execution: Experience with tools like Jira to manage certification tasks, vulnerability remediation and feature tracking across all our certification products distributed our global teams. (Primary South Korea, India, Ukraine, the United Kingdom, and the United States)
• Global Schedule Adaptability: Ability to participate in technical or other working sessions across international time zones outside standard 8:00 AM – 5:00 PM local hours as required by global product release milestones

Requirements:

• A Master's or Ph.D. in Computer Science or Security
• Bachelor's degree in Computer Science or a related engineering discipline
• or an equivalent combination of education, training, and experience
• 3+ years of direct, hands-on engineering experience in Common Criteria and/or FIPS 140-3 certification
• Strong knowledge of common security related protocols and their design (i.e., SSH, IPsec, TLS, etc.)
• Comprehensive understanding of Android Framework architecture, CC specifications, and FIPS 140-3 (ISO/IEC 19790)
• Familiarity with NIST SP 800-series standards, ACVP JSON tooling, and Jira workflow management