Senior Firmware Security Engineer

Lenovo is seeking a Senior Firmware Security Engineer to support its PCSD Product Security team, focused on protecting BIOS/UEFI and other platform firmware across Lenovo products. In this onsite role in Morrisville, North Carolina, you will conduct independent security reviews and testing, identify firmware risks, and help validate remediation with development and security partners.

What you’ll do

• Perform security reviews and testing for BIOS, UEFI, embedded controllers, and other platform firmware across Lenovo products.
• Independently scope and execute firmware security assessments based on product architecture, attack surfaces, and security requirements.
• Identify and analyze firmware and hardware security vulnerabilities, including evaluating their potential impact.
• Partner with development and security teams to communicate findings, recommend mitigations, and validate remediation outcomes.
• Evaluate firmware security controls and platform protections, including boot security, hardware-backed security, and related platform security capabilities.
• Conduct threat modeling and attack-surface analysis for firmware and platform components.
• Research emerging firmware and hardware attack techniques and apply relevant testing methods to Lenovo products.
• Develop and enhance firmware security testing methodologies, tools, and automation.
• Support vulnerability analysis and risk assessment using CVE, CWE, and CVSS where applicable.
• Provide technical guidance to product development teams on firmware security risks, mitigations, and secure design practices.
• Collaborate with global product, development, and security teams to drive consistent and effective firmware security reviews.
• Use scripting, automation, and AI-enabled technologies to improve the effectiveness and scalability of firmware security testing.

Qualifications

• Bachelor’s degree in Computer Science, Computer Engineering, Electrical Engineering, Information Security, or a related field, or equivalent practical experience.
• 5+ years of experience in firmware engineering, embedded systems, cybersecurity, security engineering, or a related technical field.
• Experience with BIOS/UEFI, embedded firmware, embedded controllers, device firmware, or pre-boot environments.
• Experience performing firmware, hardware, or embedded-system security testing and assessment.
• Knowledge of security technologies such as Secure Boot, TPM, hardware roots of trust, and related platform security controls.
• Experience identifying security weaknesses, evaluating attack surfaces, and recommending or validating mitigations.
• Programming or scripting experience in languages such as C, C++, Python, or similar.
• Experience using source control systems such as Git.

Preferred qualifications

• Strong understanding of computer architecture, firmware architecture, and platform security concepts.
• Strong analytical, troubleshooting, and problem-solving skills.
• Strong written and verbal communication skills, including the ability to explain complex security issues to development and engineering teams.
• Ability to independently lead technical security reviews while collaborating effectively across global teams.
• Working knowledge of AI technologies and their application to security or engineering workflows.
• Extensive experience reviewing or developing UEFI/BIOS firmware security features on Intel, AMD, Qualcomm, or similar platforms.
• Experience with embedded controllers, microcontrollers, or real-time operating systems such as Zephyr.
• Deep knowledge of firmware and hardware security architecture, including TPM/TCG technologies and platform roots of trust.
• Experience with firmware reverse engineering, vulnerability research, fuzzing, or other advanced firmware security testing techniques.
• Experience with Windows, Linux, or device-driver development.
• Experience defining threat models and conducting security architecture or attack-surface assessments.
• Experience developing firmware security testing tools or automation frameworks.
• Familiarity with vulnerability management and disclosure practices, including CVE, CWE, and CVSS.
• Hands-on experience using AI tools to identify vulnerabilities, solve technical problems, automate testing, or improve security engineering workflows.
• Experience working within product development environments and secure development lifecycle processes.

Technologies

• BIOS/UEFI, Secure Boot, TPM, CVE, CWE, CVSS, TPM/TCG technologies (including TPM/TCG)
• C, C++, Python, Git
• AI-enabled technologies
• Zephyr
• Intel, AMD, Qualcomm
• Windows, Linux

Req #: WD00107476

Career area: Hardware Engineering

Location: Morrisville, North Carolina, United States of America (onsite)

Work schedule: Full-time

Application date: Friday, November 6, 2026