Lead Security Engineer

Responsibilities

• Design and implement security controls across all environments — network segmentation and firewalling, IDS/IPS, and traffic analysis on our on-prem Kubernetes platform.
• Build and enforce host security: EDR, kernel telemetry, hardening, and baseline implementation across the fleet.
• Own identity and access — AuthN/AuthZ, RBAC, and service identity — grounded in OIDC, SAML, and mTLS.
• Stand up incident-detection pipelines (SIEM, metrics, endpoint telemetry) tuned to surface high-signal threats over noise.
• Lead incident response end to end: triage, containment, recovery, root-cause analysis, and forensics.
• Keep the focus on enablement over restriction — effective security, not compliance for its own sake — while balancing IP protection, customer-data protection, and broad internal information sharing.
• Partner with Legal and the CISO to obtain the compliance certifications we need and to answer customer questions about the security of our systems.
• Hire and mentor as the security function grows.

Requirements

• 8+ years in security engineering, infrastructure, or related roles.
• Strong Linux system security and networking (SSH certificates, directory-based authentication).
• Strong Kubernetes security (RBAC, tenant isolation, admission control).
• Real experience securing on-prem environments, not only public cloud.
• Proven track record leading real-world incidents, with familiarity with attacker techniques (lateral movement, persistence, exfiltration).
• Hands-on depth in EDR, IDS/IPS, and SIEM.
• Strong command of OIDC, SAML, mTLS, and cryptography-based storage security.
• Comfort writing code, automation, and tooling in Python or similar.
• Configuration management via IaC (Terraform, Ansible).
• The judgment to distinguish high-signal threats from noise, make pragmatic tradeoffs in a fast-moving company, and communicate effectively with technical stakeholders.

Nice-to-Haves

• High-performance or distributed-compute experience (HPC, GPU clusters).
• Identity-aware proxies or zero-trust architectures.
• Offensive security (red teaming, exploit development).
• Secure application development and secure-code training.
• Responsible-disclosure/bug-bounty programs.
• AI controls, MCP security, agent security, and AI governance.
• Background in corporate IT security.