Roles / IP Security & Provenance Engineer

IP Security & Provenance Engineer

IP-021v1

Semiconductor IP & Design EnablementQualityIC3–IC6Individual contributor

Also known as: Hardware IP Security Engineer; IP Security Assurance Engineer; IP Provenance & HBOM Engineer; Silicon Trust Engineer

See this role on the Security lifecycle or on the Soft IP lifecycle

Summary

Ensures licensed IP is itself trustworthy — free of exploitable weaknesses, protected against extraction and cloning, and accompanied by verifiable provenance so integrators can prove where every block in their SoC came from.

A day in the life

Work in progressNo day-in-the-life description has been written for this role yet. If you do this work, we would welcome yours. Suggest a source or a correction

Responsibilities

Project

Work done for a product or program.

Perform security threat modelling and asset analysis on each IP, identifying attack surfaces, trust boundaries and security objectives.
Verify security properties formally — information flow, register access control, debug lock-down, key isolation — with JasperGold Security Path Verification or VC Formal.
Assess resistance to side-channel and fault-injection attacks on cryptographic and key-handling IP, coordinating lab evaluation where required.
Define and validate IP protection mechanisms: IEEE 1735 encryption, obfuscation, node-locking, PUF-based binding and anti-cloning features.
Build and maintain the hardware bill of materials and provenance record for each IP, tracking every third-party and open-source component and its version.
Support customer and certification-body security evaluations including Common Criteria, SESIP, PSA Certified and FIPS 140-3 module boundaries.
Manage hardware vulnerability disclosure and response for released IP, coordinating advisories, CVE handling and mitigation guidance to licensees.

Function

Work that keeps the discipline running: methods, tools, suppliers and people.

Run hardware security assurance analysis against MITRE CWE hardware weakness classes and the Accellera IP Security Assurance standard using formal and structured review.
Define secure development lifecycle requirements for IP teams aligned to ISO/SAE 21434 and IEC 62443 expectations, and audit compliance.

Major tasks

Project

Produce and hand over the role's key deliverables
- Threat model and security objective specification per IP
- Security assurance report mapped to CWE hardware weakness classes
- Formal security property verification results
- Hardware bill of materials and provenance attestation per release
- Vulnerability advisories and mitigation guidance for licensees
Qualify the productGeneral
- Write the qualification plan
- Run stress tests and analyse the results
- Approve the qualification report
Handle quality issuesGeneral
- Analyse failures
- Drive corrective and preventive action
- Respond to customers

Function

Run the quality systemGeneral
- Maintain procedures and records
- Prepare for and run audits
Report and improveGeneral
- Track quality metrics
- Lead improvement projects

Works with

Soft IP RTL Design Engineer
IP Quality Engineer
security architects at customers
certification labs
IP Licensing & Contracts Manager
IP Portfolio & Reuse Manager
PSIRT and legal

Typical backgrounds

MS in Electrical/Computer Engineering or Computer Science with hardware security or cryptography focus; 4–14 years across digital design, formal verification or security evaluation; CTF or hardware-hacking background is common.

Demand signal

0 open listings right now
0 Talent Wafer employer inquiries

Counts live listings tagged to this role, and employer interest in candidates from Talent Wafer runs for this role (all runs to date). Hub activity only, not the wider market.

Comp tier (within semis)

4 / 5

Remote feasibility

High

Semis core vs. portable

Semis-primary, transfers

Geographic hotspots

San Jose, Austin, Eindhoven, Leuven, Munich, Graz, Tel Aviv, Bengaluru, Cambridge UK, Singapore

Certifications / standards training

CISSP; ISO/SAE 21434 training; Common Criteria evaluator training; PSA Certified / SESIP familiarisation; GIAC hardware security

Transfers to (industries)

Payment and smartcard security, automotive cybersecurity, critical infrastructure and OT security, defence electronics assurance

Risk if vacant

Exploitable weaknesses and untracked third-party content ship inside licensed IP, exposing every customer SoC and blocking sales into automotive, defence and payment markets that demand security evidence.

IP Security & Provenance Engineer

Summary

A day in the life

Responsibilities

Project

Function

Major tasks

Project

Function

Works with

Register or sign in to read on