Staff Security Engineer, Firmware Security

What You’ll Do:

CoreWeave’s Security Engineering team ensures the CoreWeave Cloud is secure by design—from data centers and GPU fleets to the platform layers that power AI workloads. Within this organization, the Firmware Security function safeguards the low-level software that runs on servers, GPUs, and networking gear, ensuring it is trustworthy, up to date, and resilient against compromise.

About the role:
As a Staff Firmware Security Engineer, you will lead firmware security across CoreWeave’s infrastructure. You’ll design strategies for secure boot, firmware signing, attestation, and fleet-wide governance across servers, GPUs, and critical devices. Working hands-on with engineering teams, hardware vendors, and data center operations, you will identify risks, deploy durable controls, and respond to emerging threats in the firmware and hardware ecosystem. Your work will directly impact the security and reliability of some of the world’s largest GPU fleets.

Some of what you’ll work on:

• Define and implement the end-to-end firmware security architecture for servers, GPUs, and networking platforms, including root-of-trust, secure boot, and attestation flows.
• Design and deploy secure boot and measured boot strategies across host, BMC, and accelerator firmware, leveraging TPMs and hardware roots of trust.
• Build tooling and automation to inventory firmware, validate signatures, manage SBOMs, and enforce version baselines across large fleets.
• Partner with platform, infrastructure, and data center engineering teams to safely roll out firmware updates, including canarying, rollback strategies, and blast-radius controls.
• Conduct threat modeling, design reviews, and code reviews for firmware and low-level platform software, mitigating security risks early.
• Lead investigations into firmware vulnerabilities and anomalous device behavior, coordinating incident response and remediation.
• Collaborate with hardware and OEM partners to influence security roadmaps, validate features, and integrate vendor tooling.
• Integrate firmware security signals into telemetry, detection, and SIEM pipelines for continuous monitoring.
• Establish standards, best practices, and documentation, while mentoring engineers on secure-by-default infrastructure principles.

pythongorustawskubernetesaiiosdataproductdesign