Lead Principal Security Engineer

Job Description

The Oracle Cloud Infrastructure (OCI) team offers the opportunity to build and operate a suite of massively scaled integrated cloud services in a broadly distributed, multi‑tenant cloud environment. OCI is committed to delivering the best cloud products to meet the needs of customers tackling some of the world’s biggest challenges.

As a Consulting Hardware Security Engineer, you will ensure the compute hardware used in OCI meets the required security bar and complies with our security posture. You will define security requirements for hardware, work closely with Oracle, third‑party vendors, and standards organizations to influence the next generation of hardware platform security, and partner with OCI operations and engineering teams to continually improve operational security throughout the cloud infrastructure.

Responsibilities

• Define security requirements for hardware that align with OCI’s security posture and business needs.
• Provide independent design consulting for complex compute systems, balancing business objectives and security risks.
• Drive the implementation of required features, including provisioning, reuse, and decommissioning procedures in line with security posture.
• Conduct hands‑on security assessments of complex compute systems to verify they meet requirements.
• Perform adversarial assessments to ensure systems cannot be compromised.
• Break down complex systems for analysis, assign parts to team members, synthesize inputs, and produce a holistic assessment contextualized to cloud environments.
• Understand business objectives, assess risk through findings and threat models, and identify proper risk‑mitigation controls.
• Collaborate across teams to ensure requirements, findings, and recommendations are implemented inline with expected outcomes.
• Communicate risks and mitigation options to senior leadership, balancing security, technology, and business goals.
• Identify opportunities for security and process improvements and drive them across the organization.
• Advance the industry’s security knowledge through individual research contributions.
• Stay informed of developments and trends in your area of subject matter expertise and educate the business and security organization accordingly.
• Mentor junior engineers.

Minimum Qualifications

• Bachelor’s degree in Electrical Engineering, Computer Science, or related field, or equivalent experience.
• 10+ years of experience in hardware security architecture, engineering, validation, or planning.
• Demonstrated competency in hardware/firmware with a focus on security.
• Competency with computer architecture.
• Subject‑matter expertise in at least two of the following areas:
  • Root of Trust (TCG SRTM, DRTM)
  • x86 (Intel, AMD), ARM server platform architecture, UEFI
  • GPU platforms, rack‑scale systems, clustering
  • Baseboard Management Controllers
  • SmartNICs (DPUs)
  • Storage devices
• Knowledge of security concepts and standards such as Attestation (e.g., SPDM), cryptography, Secureboot, DICE, etc.
• Proficiency with common programming languages (C, C++, Java, Python, Ruby, Go, Rust).
• Ability to read and review complex hardware system/platform‑level schematics for security concerns.
• Experience with reversing tools and the ability to reverse engineer.
• Extensive research or experience with multiple classes of security bugs.
• Specification and/or design of hardware security features.

Preferred Qualifications

• Ability to read and understand x86 and/or ARM assembly language.
• Knowledge of vendor‑specific TEE technologies such as Intel SGX.
• Familiarity with common embedded communications interfaces (SPI, I2C, RS232‑style serial).
• Knowledge of host and network virtualization technologies and how to use them securely.
• Knowledge of enterprise and/or datacenter networking architecture.
• Experience operating in a large‑scale DevOps or CI/CD environment.
• Ability to write clear and concise product security requirements.
• Ability to assess risk from findings and threat models, and identify proper mitigation controls.
• Ability to succeed individually or collaboratively, working internally or with external organizations.
• Significant experience working effectively in a large, distributed company.
• Excellent organizational, verbal, and written communication skills.
• Experience conducting training, thought leadership, conference talks, or publications.

Benefits

• Medical, dental, and vision insurance.
• Short‑term and long‑term disability.
• Life insurance and AD&D.
• Supplemental life insurance (employee/spouse/child).
• Health care and dependent care flexible spending accounts.
• Pre‑tax commuter and parking benefits.
• 401(k) savings and investment plan with company match.
• Paid time off, paid holidays, paid sick leave, and paid parental leave.
• Adoption assistance.
• Employee Stock Purchase Plan.
• Financial planning and group legal services.
• Voluntary benefits including auto, homeowner, and pet insurance.

Equal Employment Opportunity

Oracle is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability, and protected veteran status, or any other characteristic protected by law. Oracle will consider qualified applicants with arrest and conviction records pursuant to applicable law.