Senior Firmware Security Engineer

Lenovo is seeking an experienced Firmware Security Engineer to join the PCSD Product Security team. In this role, you will perform security reviews and testing of BIOS, UEFI, embedded controller, and other platform firmware across Lenovo products. You will work closely with product development and security teams to identify firmware security risks, evaluate attack surfaces, recommend mitigations, and validate remediation. The ideal candidate brings strong firmware and platform security expertise, hands-on security testing experience, and the ability to independently lead complex security reviews across global product teams.

Responsibilities:

• Perform security reviews and testing for BIOS, UEFI, embedded controllers, and other platform firmware across Lenovo products.
• Independently scope and execute firmware security assessments based on product architecture, attack surfaces, and security requirements.
• Identify and analyze firmware and hardware security vulnerabilities and assess their potential impact.
• Partner with development and security teams to communicate findings, recommend mitigations, and validate remediation.
• Evaluate firmware security controls and platform protections, including boot security, hardware-backed security, and related platform security capabilities.
• Conduct threat modeling and attack-surface analysis for firmware and platform components.
• Research emerging firmware and hardware attack techniques and apply relevant testing methods to Lenovo products.
• Develop and enhance firmware security testing methodologies, tools, and automation.
• Support vulnerability analysis and risk assessment, including CVE, CWE, and CVSS where applicable.
• Provide technical guidance to product development teams on firmware security risks, mitigations, and secure design practices.
• Collaborate with global product, development, and security teams to drive consistent and effective firmware security reviews.
• Use scripting, automation, and AI-enabled technologies to improve the effectiveness and scalability of firmware security testing.

Basic Qualifications:

• Bachelor’s degree in Computer Science, Computer Engineering, Electrical Engineering, Information Security, or a related field, or equivalent practical experience.
• 5+ years of experience in firmware engineering, embedded systems, cybersecurity, security engineering, or a related technical field.
• Experience with BIOS/UEFI, embedded firmware, embedded controllers, device firmware, or pre-boot environments.
• Experience performing firmware, hardware, or embedded-system security testing and assessment.
• Knowledge of security technologies such as Secure Boot, TPM, hardware roots of trust, and related platform security controls.
• Experience identifying security weaknesses, evaluating attack surfaces, and recommending or validating mitigations.
• Programming or scripting experience in languages such as C, C++, Python, or similar.
• Experience using source control systems such as Git.

Preferred Qualifications:

• Strong understanding of computer architecture, firmware architecture, and platform security concepts.
• Strong analytical, troubleshooting, and problem-solving skills.
• Strong written and verbal communication skills, with the ability to explain complex security issues to development and engineering teams.
• Ability to independently lead technical security reviews while collaborating effectively across global teams.
• Working knowledge of AI technologies and their application to security or engineering workflows.
• Extensive experience reviewing or developing UEFI/BIOS firmware security features on Intel, AMD, Qualcomm, or similar platforms.
• Experience with embedded controllers, microcontrollers, or real-time operating systems such as Zephyr.
• Deep knowledge of firmware and hardware security architecture, including TPM/TCG technologies and platform roots of trust.
• Experience with firmware reverse engineering, vulnerability research, fuzzing, or other advanced firmware security testing techniques.
• Experience with Windows, Linux, or device-driver development.
• Experience defining threat models and conducting security architecture or attack-surface assessments.
• Experience developing firmware security testing tools or automation frameworks.
• Familiarity with vulnerability management and disclosure practices, including CVE, CWE, and CVSS.
• Hands-on experience using AI tools to identify vulnerabilities, solve technical problems, automate testing, or improve security engineering workflows.
• Experience working within product development environments and secure development lifecycle processes.