Sr. AI Security Engineer - Embedded Systems & Runtime Protection - Physical Team

We are Lenovo. We do what we say. We own what we do. We WOW our customers.

Lenovo is a US$83 billion revenue global technology powerhouse, ranked #153 in the Fortune Global 500, and serving millions of customers every day in 180 markets. Focused on a bold vision to deliver Smarter Technology for All, Lenovo has built on its success as the world’s largest PC company with a full-stack portfolio of AI-enabled, AI-ready, and AI-optimized devices (PCs, workstations, smartphones, tablets), infrastructure (server, storage, edge, high performance computing and software defined infrastructure), software, solutions, and services. Lenovo’s continued investment in world-changing innovation is building a more equitable, trustworthy, and smarter future for everyone, everywhere. Lenovo is listed on the Hong Kong stock exchange under Lenovo Group Limited (HKSE: 992) (ADR: LNVGY).

This transformation together with Lenovo’s world-changing innovation is building a more inclusive, trustworthy, and smarter future for everyone, everywhere. To find out more visit www.lenovo.com, and read about the latest news via our StoryHub.

Candidate must be willing to work onsite three days a week in our Tel-Aviv, Israel office.

Join Lenovo’s Physical AI Security team to develop security technologies for intelligent devices, including smart cameras, ambient systems, robots, and autonomous platforms. You will build runtime protection that detects compromise, identifies misuse of device capabilities, and enables controlled containment and recovery.

This role combines security research with embedded Linux engineering, behavioral detection, and an understanding of how software, AI, and device commands affect physical operation.

Job Responsibilities

• Develop lightweight security agents and SDKs for Linux-based devices, balancing security coverage with CPU, memory, latency, and connectivity constraints.
• Collect and correlate process, network, file-access, and privilege events with application activity, AI-driven requests, and device commands to reconstruct attack chains and assess operational impact.
• Develop detection logic for exploitation, privilege escalation, persistence, unexpected execution, and abuse of legitimate services or identities to perform unauthorized operations.
• Define application capability profiles and enforce permitted access to resources, services, and control interfaces. Identify unauthorized expansion of privileges across software and configuration updates.
• Build mechanisms to revoke access, restrict commands, contain compromised components, and restore approved operation while respecting essential device functions and, for robots, control and safety requirements.
• Develop secure telemetry pipelines, incident correlation, and investigation timelines that connect device activity, detection evidence, response actions, and observed outcomes.
• Reproduce realistic attacks on embedded and robotic systems, evaluate detection bypasses, and measure false positives, response effectiveness, resource overhead, and operational disruption.
• Collaborate with product teams and OEM partners to embed reusable protection into different platforms, including robotics through ROS 2, application APIs, and command interfaces.
  
  

• B.Sc. in Computer Science, Computer Engineering, Electrical Engineering, or equivalent practical experience.
• Strong C/C++, Python, and Linux systems programming, with experience developing production software for embedded or resource-constrained environments.
• Strong understanding of Linux internals, including processes, permissions, capabilities, namespaces, system calls, networking, and inter-process communication.
• Experience in cybersecurity engineering or research involving embedded systems, Linux platforms, IoT devices, or cyber-physical systems.
• Hands-on experience with runtime instrumentation or enforcement mechanisms such as eBPF, Linux Security Modules, seccomp, or Linux auditing, including their platform dependencies and limitations.
• Ability to translate threat models and attack techniques into practical telemetry, behavioral detections, enforceable policies, and reproducible security tests.
• Experience building reliable agents or services, including secure communications, device identity, configuration management, offline operation, and performance optimization.
• Experience with event processing, detection pipelines, or security investigation tooling, with an emphasis on explaining alerts and managing incomplete evidence.
  
  

• Familiarity with robotics middleware, ROS/ROS 2, AI inference pipelines, or device-control interfaces is an advantage.
• An M.Sc. or Ph.D. with relevant research experience is an advantage.
  
  

• Disability Insurance
• Health Insurance
• Pension Fund
• Retirement Fund
• Study Fund
• Meal Allowance
• Employee Referral Bonus
• Employee Assistance Program
• 10% discount on Lenovo products
• Internal e-learning platform