Platform Security Engineer, DRTM / Secure Launch

About the role

Anthropic is building the platform security foundation for the infrastructure that trains and serves frontier AI models. The Platform Security Engineer will own the Dynamic Root of Trust for Measurement (DRTM) across Anthropic’s fleet, bringing it up on x86 and ARM, building attestation and isolation capabilities, and hardening the platform beyond DRTM.

Key responsibilities

• Own adoption and integration of DRTM hardware security features on x86 and ARM platforms.
• Implement attestation services and related security and privacy capabilities enabled by DRTM.
• Design and implement a bootloader‑agnostic solution for initiating and relaunching DRTM sessions.
• Investigate hardening of existing DRTM solutions, including PPAM isolation of SMM on x86, VMM isolation of UEFI runtime services, and ACPI handling in DRTM environments.
• Interface with vendor and OEM partners to refine DRTM requirements and influence product changes.
• Publish DRTM work upstream, contribute to Linux Secure Launch maintainership, and replace tboot.
• Lead technical architecture and design, disseminating work through papers, conference talks, and community engagement.
• Build and harden additional platform security features such as confidential computing (TDX, SEV).
• Develop custom OS artifacts, device drivers for custom hardware, and perform firmware diagnosis and enhancements.
• Debug and diagnose kernel and system‑level issues on production hardware.
• Investigate security problems in dTPMs and fTPMs.

Required profile

• Deep hands‑on experience with low‑level platform security (firmware, bootloaders, kernel, silicon).

Required skills

• DRTM (Dynamic Root of Trust for Measurement)
• Firmware and bootloader development
• Linux kernel development
• x86 and ARM architecture
• Attestation services
• Secure boot and UEFI
• Confidential computing technologies (TDX, SEV)
• Device driver development
• Hardware security features (SMM, VMM, ACPI)
• Upstream open‑source contribution (Linux Secure Launch)