Sr. Security & Test Engineer - Device OS (PKI & Firmware Security)

About the role

Calling all innovators - find your future at Fiserv.

We're Fiserv, a global leader in Fintech and payments, and we move money and information in a way that moves the world. We connect financial institutions, corporations, merchants and consumers to one another millions of times a day - quickly, reliably, and securely. Any time you swipe your credit card, pay through a mobile app, or withdraw money from the bank, we're involved. If you want to make an impact on a global scale, come make a difference at Fiserv.

Job Title

About your role:

Clover, a Fiserv company, is a global leader in point-of-sale platforms powering millions of small businesses worldwide with integrated smart hardware, software, and secure payment solutions.In this role, you will join the DeviceOS Quality & Security Engineering team, which owns the low-level platform software, secure boot infrastructure, and factory-provisioning firmware powering millions of Clover devices. You will serve as the hands-on security validation lead responsible for designing security test harnesses, executing vulnerability and penetration testing, automating cryptographic test suites, and validating embedded PKI/HSM key injection architectures. If you are a builder and breaker who loves testing embedded security protocols, fuzzing device endpoints, and verifying hardware against strict payment security standards (PCI-PTS, PCI-PIN), this is your team.

What you’ll do:

• Automated Security Test Engineering: Design, build, and maintain automated security test frameworks and test beds (in Python) to continuously validate platform security across Android (AOSP) and Linux-based POS smart terminals.
• Cryptographic & Key Management Testing: Author automated test suites to validate cryptographic handshakes, TLS/mTLS configurations, digital signature verifications, and Hardware Security Module (HSM, e.g., Thales) key generation, injection, and rotation workflows.
• Penetration Testing & Vulnerability Assessment: Conduct hands-on vulnerability assessments, API fuzzing, interface testing, and penetration testing against device operating systems, bootloaders, and local communication endpoints (USB, serial, network).
• Compliance & Standards Verification: Translate PCI-PTS, PCI-PIN, and EMVCo security specifications into executable verification plans, validating device tamper responses, secure key storage, and PIN-entry security mechanisms.
• Firmware & Supply Chain Security Validation: Build automated test gates within CI/CD pipelines (GitHub Actions/Jenkins) to scan golden images, audit kernel/bootloader integrity, verify Secure Boot chains, and detect supply-chain vulnerabilities before mass manufacturing.
• Defect Triage & Security Root-Cause Analysis (RCA): Partner directly with embedded OS developers and firmware engineers to isolate, reproduce, and verify fixes for cryptographic flaws, security regressions, and Common Vulnerabilities and Exposures (CVEs).

Experience you’ll need to have:

• 5+ years of dedicated professional experience in Security Testing, Software Quality Engineering (SDET), Embedded Security, or Application Security (AppSec).
• Hands-on Test Automation & Scripting: Strong programming skills in Python (plus Bash or Shell) to build automated test scripts, mock interfaces, and diagnostic test harnesses from scratch.
• Applied Cryptography & PKI Testing: Deep technical understanding of how to test and validate cryptographic algorithms (AES, RSA, ECC, HMAC), TLS/mTLS handshakes, certificate authority (CA) chains, and HSM-backed key operations.
• Operating Systems & Endpoint Debugging: Proven experience testing and debugging within Linux/UNIX or Android (AOSP) environments using command-line diagnostic tools (adb, Logcat, OpenSSL, Wireshark, system logs).
• Vulnerability Analysis & Fuzzing: Demonstrated ability to perform hands-on security assessments using tools such as Burp Suite, OWASP ZAP, Nmap, Metasploit, or custom fuzzing scripts.
• Secure CI/CD Integration: Experience integrating automated security checks, static/dynamic scanning, or automated regression runs into CI/CD build pipelines (Jenkins, GitHub Actions, GitLab CI).

Experience that would be great to have:

• Prior experience testing or certifying devices against payment industry standards: PCI-PTS, PCI-PIN, EMVCo, or Common Criteria.
• Direct experience with Hardware Security Modules (HSMs), specifically validating secure factory key injection or PIN translation.
• Hands-on familiarity with Android platform security internals (SELinux policy testing, verified boot / dm-verity, TrustZone, keystore).
• Industry security certifications such as OSCP, CEH, GWAPT, CISSP, or equivalent practical security research experience.

How you’ll work:

• This role is on-site Monday through Friday. Fiserv considers in-person collaboration to be an essential part of this role as in-person office experiences help you with your overall onboarding experience and leads to stronger productivity.
• This role requires use of a computer and audio equipment.

Benefits at Fiserv:

• Fuel Your Life program to support your physical, financial, social, and emotional well-being
• Paid holidays and generous time away policies
• No-cost mental health support through Employee Assistance Programs
• Living Proof program to recognize your peers’ extra effort with points redeemable for rewards
• Eight Employee Resource Groups to foster a collaborative culture and expand your network
• ·Unparalleled professional growth with training, development, and internal mobility opportunities
• Medical, dental, vision, life, and disability insurance options available from day one
• Retirement planning and discounted shares with the Employee Stock Purchase Plan
• Tuition assistance and reimbursement program
• Paid parental, caregiver, and military leave

#LI-SH2

Salary Range

These pay ranges apply to employees in Sunnyvale, California. Pay ranges for employees in other states may differ.

It is unlawful to discriminate against a prospective employee due to the individual's status as a veteran.

Thank you for considering employment with Fiserv.  Please:

• Apply using your legal name
• Complete the step-by-step profile and attach your resume (either is acceptable, both are preferable).

Our commitment to Equal Opportunity:

Fiserv is proud to be an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, gender, gender identity, sexual orientation, age, disability, protected veteran status, or any other category protected by law. 

If you have a disability and require a reasonable accommodation in completing a job application or otherwise participating in the overall hiring process, please contact [email protected]. Please note our AskHR representatives do not have visibility to your application status. Current associates who require a workplace accommodation should refer to Fiserv’s Disability Accommodation Policy for additional information.

Note to agencies:

Fiserv does not accept resume submissions from agencies outside of existing agreements. Please do not send resumes to Fiserv associates. Fiserv is not responsible for any fees associated with unsolicited resume submissions.

Warning about fake job posts:

Please be aware of fraudulent job postings that are not affiliated with Fiserv. Fraudulent job postings may be used by cyber criminals to target your personally identifiable information and/or to steal money or financial information. Any communications from a Fiserv representative will come from a legitimate Fiserv email address.