Defense Cyber-Physical Systems Engineer

About the role

You will join a defense technology company securing the systems where software meets physics: vehicles, weapons, and control systems where a digital compromise becomes physical consequence. The cyber-physical team treats a compromised controller as a safety event, not just an IT incident, hardening embedded systems so that even a breached network cannot move a real actuator the wrong way. Your work spans threat modeling, secure embedded design, and adversarial testing, and it is validated on hardware-in-the-loop rigs that prove safety properties under attack.

What you will achieve

• Implement secure boot and measured boot chains on an embedded platform, closing the top three firmware tampering paths identified in threat modeling.
• Build hardware-in-the-loop test rigs that validate controller behavior under cyber attack scenarios, catching unsafe responses before fielding.
• Deliver threat models for two cyber-physical subsystems, with mitigations traced to requirements and verified in test.
• Cut vulnerability remediation time by half through automated static analysis and fuzzing integrated into the firmware build pipeline.
• Demonstrate that safety-critical control functions remain correct and available during a simulated network compromise.
• Prove on a hardware-in-the-loop rig that safety-critical functions remain correct during active network attack scenarios.

What you will bring

Must-haves

• You bring 2 to 5 years of experience in embedded systems, control systems, or product security engineering.
• You understand embedded security primitives: secure boot, key storage, attestation, and encrypted firmware update.
• You have worked with real-time operating systems and the constraints of deterministic control loops.
• You can threat-model a cyber-physical system, identifying how digital compromise becomes physical consequence.
• You code in C or C++ for resource-constrained targets and review code for memory safety and logic flaws.
• You test adversarially, thinking like an attacker about interfaces, timing, and failure modes.
• You have implemented or reviewed cryptographic protocols for constrained devices, understanding their performance and security tradeoffs.

Nice-to-haves

• You have performed penetration testing or red teaming against embedded or industrial systems.
• You bring control theory background and understand stability under fault or attack.
• You have worked with hardware security modules or trusted platform modules.
• You are eligible for a U.S. security clearance.
• You bring experience with safety certification standards and how security evidence maps to safety cases.