2 months ago
Base Salary
$179k - $224k/yr
Responsibilities
- Own threat modeling and security design reviews for vehicle architectures, ECUs, firmware, secure boot, key management, vehicle communications, and OTA systems.
- Write and drive adoption of functional and non-functional security requirements with platform engineering teams.
- Document vehicle and customer data flows and specify data minimization, retention, and deletion requirements.
- Build and validate privacy enforcement mechanisms including telemetry scrubbing, de-identification, consent handling, and deletion handling.
- Design and review PKI for device identity, factory provisioning, code and OTA signing, mutual TLS, Plug and Charge credentials, and fleet certificate lifecycle management.
- Assess RVT security deliverables, reproduce and analyze product vulnerabilities, and determine exploitability and remediation direction.
- Author security and privacy engineering standards and reference patterns and drive their adoption.
- Scope security testing with offensive security and penetration testing teams and turn findings into requirements and standards changes.
- Participate in technical working groups with RVT Product Security and build tooling, analysis harnesses, test fixtures, and data-handling pipelines.
Requirements
- 8+ years of security engineering experience with substantial hands-on experience in embedded, automotive, or safety-critical product security.
- Hands-on capability in several areas including firmware analysis and reverse engineering, secure boot and chain of trust, SoC and ECU security, automotive network protocols, hardware-backed key management, and OTA update security.
- Applied PKI experience including key hierarchy design, HSM-backed roots, certificate provisioning and rotation, revocation at scale, and device certificate operations.
- Practical privacy engineering experience with data-flow documentation, minimization and retention design, or de-identification, scrubbing, and deletion mechanisms in a shipping product.
- Demonstrated ownership of threat modeling and design reviews for shipping products and experience driving security requirements into teams without direct management authority.
- Working knowledge of ISO/SAE 21434 and UNECE R155/R156.
- Preferred experience includes embedded or vehicle offensive security, fuzzing, hardware attacks, side-channel or fault injection, sensor or camera data de-identification, privacy-preserving telemetry, GDPR, CCPA, automotive TARA programs, ISO 15118 Plug and Charge, V2X credential systems, crypto-agility, post-quantum migration, charging infrastructure, or high-voltage systems security.
Benefits
- Comprehensive benefits for eligible full-time and part-time employees and covered dependents, including paid vacation, paid sick leave, life, medical, dental, vision, short-term disability, and long-term disability insurance.
- Eligible employees may participate in Rivian’s 401(k) Plan and Employee Stock Purchase Program.
- Full-time employee coverage begins on the first day of employment; part-time employee coverage begins the first of the month after 90 days.
- The role is located in Atlanta, Georgia and is a full-time position with possible annual performance bonus and equity eligibility.
About Rivian
Rivian designs and manufactures electric vehicles, including the R1T pickup, R1S SUV, and commercial delivery vans, selling directly to consumers and fleet operators. Founded in 2009 and headquartered in Irvine, California, it operates a manufacturing plant in Normal, Illinois, and is publicly traded on NASDAQ. The company also develops in-vehicle software and electrical architecture and offers charging and service support for its owners.