Security Engineer

About the Role

We're hiring our first dedicated Security Engineer to own security across a growing and technically diverse footprint: cloud infrastructure, software development practices, control systems, and data collection pipelines. You'll work alongside our IT Systems Administrator, who owns day-to-day device/identity operations - you'll set the security strategy, standards, and technical controls, and partner with them on enforcement. This role sits at the intersection of cloud security, DevSecOps, and OT/control-systems security with real ownership from day one.

What We Value

• Obsess about the details - sloppy work costs us later, so do it right the first time.
• Care - pick up the trash. Do things no one asks you to do. Go the extra mile because you care.
• Act with urgency - every hour matters more than it feels like it does.
• Be responsible for the outcome, not just the task; if it is not working, it remains your problem until it is fixed.
• Assume good intent - disagree openly, then commit fully once a call is made.

Core Responsibilities

• Own security posture for AWS infrastructure managed via Terraform and Spacelift, including IAM policy review, secrets management, and network segmentation.
• Partner with engineering to build security into the SDLC and CI/CD pipeline - code scanning, dependency/vulnerability management, secure defaults for new services.
• Assess and secure control systems and data collection infrastructure.
• Own and operate our security monitoring and detection tooling; triage alerts and build out detection coverage over time.
• Define access-control standards (conditional access, least privilege, MFA policy) in IdP and across SaaS tools; partner with IT Admin on enforcement.
• Define MDM security baselines (macOS/Windows) for IT to implement and maintain.
• Build and lead incident response efforts when issues arise.
• Track security risk across the environment and lay groundwork for relevant compliance frameworks as the company matures.
• Run periodic security awareness efforts (phishing simulations, training) for a non-security-native team.

Minimum Qualifications

• 4+ years in a security engineering role spanning cloud security and application/DevSecOps work.
• Strong hands-on experience with AWS and Infrastructure-as-Code (Terraform).
• Practical experience with identity security - SSO/IdP policy (Okta or equivalent), conditional access, least-privilege design.
• Experience with a security monitoring/detection platform (SIEM, EDR, or specialized tools) - alert triage, tuning, investigation.
• Solid understanding of secure SDLC practices - SAST/DAST, dependency scanning, secrets management, code review for security issues.
• Strong ability to communicate risk clearly to non-security stakeholders and make pragmatic trade-offs for a small, fast-moving company.

Preferred Qualifications

• Direct experience securing control systems, OT, or industrial environments.
• Experience with CI/CD-integrated IaC workflows (Spacelift or similar).
• Experience with data collection pipeline security (data integrity, sensor/telemetry access controls).
• Prior experience as employee #1 or #2 on a security team, building programs from scratch.
• Compliance experience (SOC 2, ISO 27001, NIST, or sector-specific frameworks relevant to hardware/control systems companies).
• Scripting/automation skills (Python, Go) to build custom detections or automate security tooling.
• Experience in a company where hardware, CAD/simulation workstations, or physical systems intersect with traditional IT.

Additional Requirements

• Comfortable being the sole dedicated security resource, setting strategy while partnering with IT for day-to-day enforcement.
• Availability for incident response outside standard business hours when needed.
• Based in or willing to work from our San Leandro, CA office given the control systems and hardware-adjacent scope of the role.
• Occasional travel to other Fuse locations.
• Willingness to obtain relevant certifications (e.g., AWS Security, GIAC/GSEC) if not already held, as the role and compliance needs mature.

Benefits

• Medical, dental, and vision coverage.
• Relocation assistance for roles that require it.
• Flexible time off. Take what you need, no accrual tracking.
• 2 weeks of paid time off built into the end of each year (subject to team and business needs).
• Supportive leave of absence policies.
• Paid leave for new parents.

Itar Requirements

To conform to U.S. Government technology export regulations, including the International Traffic in Arms Regulations (ITAR), you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.