About the role:
We need a hands-on firmware consultant who owns the cellular stack end to end: modem integration, RF bring-up, firmware, carrier and regulatory certification.
You will work onsite in Oak Brook alongside hardware, firmware, cloud and compliance teams to take products from prototype through certification and production.
Key responsibilities:
Cellular firmware:
Design, develop and debug embedded C/C++ firmware integrating LTE-M, NB-IoT and/or LTE Cat-1/Cat-1bis modules into commercial door and lift controllers.
Integrate modems (e.g., Nordic nRF91, Quectel, u-blox, Telit, Sierra Wireless) via AT commands or vendor SDKs.
Implement network attach, PDP context, PSM/eDRX power saving, reconnect and fallback logic.
Build secure connectivity to the cloud: TLS/DTLS, MQTT/CoAP, device provisioning, and certificate management.
Implement and validate firmware-over-the-air (FOTA) updates for both the host MCU and the modem.
Support SIM, eSIM/eUICC and carrier profile management.
Radio and hardware:
Partner with hardware engineers on antenna selection, placement and tuning inside metal commercial enclosures.
Run RF bring-up and performance testing (TRP/TIS, signal quality, coverage) using call boxes and network emulators.
Debug with spectrum analyzers, logic analyzers, modem trace tools and JTAG/SWD.
Regulatory and carrier certification:
Lead the product through FCC (Part 15, 22, 24, 27), ISED, PTCRBF and carrier certification (AT&T, Verizon, T-Mobile).
Coordinate with test labs, module vendors and carriers; prepare test plans and certification documentation.
Address RF exposure, EMC and module-certification reuse requirements.
Collaboration:
Work with product management, cloud, QA and compliance to define requirements and test strategy.
Document architecture, design decisions and test results; mentor internal engineers on cellular best practices.
Required qualifications:
8+ years of embedded firmware development in C/C++ on 32-bit MCUs (ARM Cortex-M or similar).
4+ years hands-on with cellular IoT (LTE-M, NB-IoT, LTE Cat-1, or Cat-4) shipped in production products.
Deep knowledge of 3GPP LTE concepts: attach/registration, bands, PSM/eDRX, RRC states, roaming.
Direct experience taking a cellular product through PTCRBF and at least one US carrier certification.
Working knowledge of FCC/ISED regulatory requirements for intentional radiators.
RTOS experience (FreeRTOS, Zephyr, ThreadX or similar).
Comfortable with lab RF tools: call box/network emulator, spectrum analyzer, oscilloscope.
Able to work onsite in Oak Brook, IL.
Bachelor's degree in Electrical Engineering, Computer Engineering or equivalent experience.
Preferred qualifications:
Experience in garage door, access control, building automation, industrial IoT or other commercial connected products.
Hands-on with Nordic nRF91 series and the nRF Connect SDK / Zephyr.
Knowledge of LTE Cat-1bis, 5G RedCap or 2G/3G sunset migration.
Background in antenna design or RF hardware, not just firmware.
Experience with AWS IoT, Azure IoT Hub or similar device clouds.
Familiarity with product security standards (UL 2900, ETSI EN 303 645, IEC 62443).
Experience with UL safety requirements for motorized door operators (e.g., UL 325).