Sr. Security & Test Engineer - Device OS (PKI & Firmware Security)

We connect financial institutions, corporations, merchants and consumers to one another millions of times a day - quickly, reliably, and securely.

If you want to make an impact on a global scale, come make a difference at Fiserv. Job Title Sr.

& Test Engineer - Device OS (PKI & Firmware Security) About your role: Clover, a Fiserv company, is a global leader in point-of-sale platforms powering millions of small businesses worldwide with integrated smart hardware, software, and secure payment solutions.In this role, you will join the DeviceOS Quality & Security Engineering team, which owns the low-level platform software, secure boot infrastructure, and factory-provisioning firmware powering millions of Clover devices. You will serve as the hands-on security validation lead responsible for designing security test harnesses, executing vulnerability and penetration testing, automating cryptographic test suites, and validating embedded PKI/HSM key injection architectures.

About There's a reason why Fiserv

• Calling all innovators - find your future at Fiserv.
• We're Fiserv, a global leader in Fintech and payments, and we move money and information in a way that moves the world.
• Any time you swipe your credit card, pay through a mobile app, or withdraw money from the bank, we're involved.

Responsibilities

• If you are a builder and breaker who loves testing embedded security protocols, fuzzing device endpoints, and verifying hardware against strict payment security standards (PCI-PTS, PCI-PIN), this is your team.
• Automated Security Test Engineering: Design, build, and maintain automated security test frameworks and test beds (in Python) to continuously validate platform security across Android (AOSP) and Linux-based POS smart terminals.
• Author automated test suites to validate cryptographic handshakes, TLS/mTLS configurations, digital signature verifications, and Hardware Security Module (HSM, e.g., Thales) key generation, injection, and rotation workflows.
• Conduct hands-on vulnerability assessments, API fuzzing, interface testing, and penetration testing against device operating systems, bootloaders, and local communication endpoints (USB, serial, network).
• Translate PCI-PTS, PCI-PIN, and EMVCo security specifications into executable verification plans, validating device tamper responses, secure key storage, and PIN-entry security mechanisms.
• Build automated test gates within CI/CD pipelines (GitHub Actions/Jenkins) to scan golden images, audit kernel/bootloader integrity, verify Secure Boot chains, and detect supply-chain vulnerabilities before mass manufacturing.
• Defect Triage & Security Root-Cause Analysis (RCA): Partner directly with embedded OS developers and firmware engineers to isolate, reproduce, and verify fixes for cryptographic flaws, security regressions, and Common Vulnerabilities and Exposures (CVEs).
• Strong programming skills in Python (plus Bash or Shell) to build automated test scripts, mock interfaces, and diagnostic test harnesses from scratch.
• Deep technical understanding of how to test and validate cryptographic algorithms (AES, RSA, ECC, HMAC), TLS/mTLS handshakes, certificate authority (CA) chains, and HSM-backed key operations.
• Proven experience testing and debugging within Linux/UNIX or Android (AOSP) environments using command-line diagnostic tools (adb, Logcat, OpenSSL, Wireshark, system logs).

Requirements

• 5+ years of dedicated professional experience in Security Testing, Software Quality Engineering (SDET), Embedded Security, or Application Security (AppSec).
• Demonstrated ability to perform hands-on security assessments using tools such as Burp Suite, OWASP ZAP, Nmap, Metasploit, or custom fuzzing scripts.
• Hands-on familiarity with Android platform security internals (SELinux policy testing, verified boot / dm-verity, TrustZone, keystore).

Preferred

• Experience integrating automated security checks, static/dynamic scanning, or automated regression runs into CI/CD build pipelines (Jenkins, GitHub Actions, GitLab CI).
• Experience that would be great to have: Prior experience testing or certifying devices against payment industry standards: PCI-PTS, PCI-PIN, EMVCo, or Common Criteria.
• Direct experience with Hardware Security Modules (HSMs), specifically validating secure factory key injection or PIN translation.
• Industry security certifications such as OSCP, CEH, GWAPT, CISSP, or equivalent practical security research experience.

Pay

Pay ranges for employees in other states may differ.

For incentive eligible associates, the successful candidate is eligible for an annual incentive opportunity which may be delivered as a mix of cash bonus and equity awards in the Company’s sole discretion.

Benefits

• Fuel Your Life program to support your physical, financial, social, and emotional well-being
• Paid holidays and generous time away policies No-cost mental health support through Employee Assistance Programs Living Proof program to recognize your peers’ extra effort with points redeemable for rewards
• Eight Employee Resource Groups to foster a collaborative culture and expand your network ·Unparalleled professional growth with training, development, and internal mobility opportunities
• Medical, dental, vision, life, and disability insurance options available from day one Retirement planning and discounted shares with the Employee Stock Purchase Plan Tuition assistance and reimbursement program
• Paid parental, caregiver, and military leave #LI-SH2 Salary Range $140,000.00 - $210,000.00 These pay ranges apply to employees in Sunnyvale, California.
• It is unlawful to discriminate against a prospective employee due to the individual's status as a veteran.
• Thank you for considering employment with Fiserv.

How you’ll work

This role is on-site Monday through Friday. Fiserv considers in-person collaboration to be an essential part of this role as in-person office experiences help you with your overall onboarding experience and leads to stronger productivity. This role requires use of a computer and audio equipment.

Please

Apply using your legal name Complete the step-by-step profile and attach your resume (either is acceptable, both are preferable).

Our commitment to Equal Opportunity

Fiserv is proud to be an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, gender, gender identity, sexual orientation, age, disability, protected veteran status, or any other category protected by law. If you have a disability and require a reasonable accommodation in completing a job application or otherwise participating in the overall hiring process, please contact [email protected] . Please note our AskHR representatives do not have visibility to your application status. Current associates who require a workplace accommodation should refer to Fiserv’s Disability Accommodation Policy for additional information.

Note to agencies

Fiserv does not accept resume submissions from agencies outside of existing agreements. Please do not send resumes to Fiserv associates. Fiserv is not responsible for any fees associated with unsolicited resume submissions.

Warning about fake job posts

Please be aware of fraudulent job postings that are not affiliated with Fiserv. Fraudulent job postings may be used by cyber criminals to target your personally identifiable information and/or to steal money or financial information. Any communications from a Fiserv representative will come from a legitimate Fiserv email address.