Security Engineer
"What You'll Be Doing"
About This Role
Note: To conform to U.S. Government technology export regulations, including ITAR, applicants must be a U.S. citizen, lawful permanent resident, protected individual as defined by 8 U.S.C. 1324b(a)(3), or otherwise eligible to obtain required authorizations from the U.S. Department of State.
What You'll Be Doing
Own the security posture of our AWS infrastructure, which is managed via Terraform and Spacelift, including reviewing IAM policies, managing secrets, and handling network segmentation.
Partner with engineering to build security into the SDLC and CI/CD pipeline, covering code scanning, dependency and vulnerability management, and secure defaults for new services.
Assess and secure control systems and data collection infrastructure.
Own and operate our security monitoring and detection tooling, triaging alerts and expanding detection coverage over time.
Define access-control standards (conditional access, least privilege, MFA policy) across our identity provider and SaaS tools, partnering with the IT Admin on enforcement.
Define MDM security baselines for macOS/Windows for IT to implement and maintain.
Build and lead incident response efforts when issues arise.
Track security risk across the environment and lay groundwork for relevant compliance frameworks as the company matures.
Run periodic security awareness efforts, such as phishing simulations and training, for a team that is not security-native.
What We're Looking For
4+ years in a security engineering role spanning cloud security and application/DevSecOps work.
Strong hands-on experience with AWS and Infrastructure-as-Code (Terraform).
Practical experience with identity security, including SSO/IdP policy (Okta or equivalent), conditional access, and least-privilege design.
Experience with a security monitoring/detection platform (SIEM, EDR, or specialized tools), including alert triage, tuning, and investigation.
Solid understanding of secure SDLC practices, including SAST/DAST, dependency scanning, secrets management, and security-focused code review.
Strong ability to communicate risk clearly to non-security stakeholders and make pragmatic trade-offs for a small, fast-moving company.
Comfort being the sole dedicated security resource, setting strategy while partnering with IT on day-to-day enforcement.
Availability for incident response outside standard business hours when needed.
Willingness to be based in or work from the San Leandro, CA office, given the control systems and hardware-adjacent scope of the role, with occasional travel to other Fuse locations.
Willingness to obtain relevant certifications (such as AWS Security or GIAC/GSEC) if not already held, as the role and compliance needs mature.
Bonus Points
Direct experience securing control systems, OT, or industrial environments.
Experience with CI/CD-integrated IaC workflows, such as Spacelift or similar tools.
Experience with data collection pipeline security, including data integrity and sensor/telemetry access controls.
Prior experience as employee #1 or #2 on a security team, building programs from scratch.
Compliance experience with frameworks such as SOC 2, ISO 27001, NIST, or sector-specific frameworks relevant to hardware/control systems companies.
Scripting/automation skills (Python, Go) to build custom detections or automate security tooling.
Experience in a company where hardware, CAD/simulation workstations, or physical systems intersect with traditional IT.
Why Join Us
Medical, dental, and vision coverage.
Relocation assistance for roles that require it.
Flexible time off, with no accrual tracking.
Two weeks of paid time off built into the end of each year, subject to team and business needs.
Supportive leave of absence policies.
Paid leave for new parents.
Ready to Apply?
To submit your application for this position, please visit Fuse Energy's official website and follow their application process.