Summary
What you’ll impact
The Lead Security Engineer defines, implements, and maintains organization-wide security and IT controls for hardware, software, and cloud platforms. They secure source-code repositories, CI/CD pipelines, cloud infrastructure, network segmentation, and identity-access management using encryption, SSO, MFA, and least-privilege policies. Responsibilities include achieving NIST SP 800-171/CMMC compliance, managing export-control requirements, overseeing device fleet, MDM, and multi-site networking operations. They work with engineering, legal, and product teams, lead architecture reviews, and mentor staff on security best practices.
Responsibilities
What you'll do
- Design and enforce how our source code, compiler toolchain, and hardware designs are protected: classification, encryption, storage, and who can reach what.
- Own the access model across our engineering systems: repository permissions, token and credential governance, and recurring access reviews.
- Establish controls for sensitive technical data we hold under third-party confidentiality obligations.
- Build and maintain the evidence that we take reasonable measures to protect our trade secrets
- Secure a developer-heavy, multi-platform engineering environment where off-the-shelf tooling doesn’t always fit, and make hardening work for engineers rather than against them.
- Secure our software supply chain end to end: dependencies, build pipelines, release integrity, and the compiler itself.
- Own network and infrastructure security architecture, including build-vs-buy and in-house-vs-managed decisions.
- Work with our technology vendors and service providers as a technical peer, not a ticket queue.
- Own detection, logging, and incident response, and write the playbooks you’ll run.
- Own and mature our NIST SP 800-171 and CMMC programs: assessments, system security plans, POA&Ms, SPRS, remediation, and audit readiness.
- Lead the security side of customer, partner, and investor diligence, including security questionnaires and government customer reviews.
- Establish policies and controls for handling sensitive and controlled information, and train employees on them.
- Own the technical implementation of our export control obligations: access segregation, U.S.-person gating for controlled technology, and deemed export analysis for system and repository access.
- Partner with Legal on classification, licensing, and restricted party screening.
- Set and administer how AI tools are used against our most sensitive material: which tools are approved, how they’re provisioned, and how sensitive data stays where it belongs.
- Own AI tool spend and seat management, so budget goes where it delivers value (not every task needs a frontier model).
- Serve as the company’s data protection and privacy lead.
- Own day-to-day IT across all offices: hardware, software, accounts, and access. No ask is too small, and you’ll build systems so the small asks stay small.
- Run onboarding and offboarding end to end: provisioning, deprovisioning, access reviews, and equipment lifecycle.
- Manage the device fleet and MDM: configuration baselines, patching, disk encryption, and endpoint security.
- Administer identity and access: SSO, MFA, automated user provisioning, and role-based access across our SaaS stack.
- Own office IT infrastructure across multiple sites: networking, Wi-Fi with certificate-based authentication, conference rooms and AV, and physical access systems where applicable.
- Manage IT vendors, licensing, and renewals, and keep spend sensible.
- Build the security and IT roadmap for where we need to be as headcount, offices, and customer requirements grow, and drive it, rather than waiting for requirements to arrive.
- Advise leadership on security and IT strategy, budget, and build-vs-buy decisions.
- Help hire our first dedicated IT Manager, hand off day-to-day operations, and lay the groundwork for a security and IT team.
Requirements
What you’ll bring
- 7+ years in information security, including time as the founding or sole security owner at a company—or as the person who built a program that didn’t exist before you arrived.
- Genuine hands-on depth. You can configure the control, not just specify it, including on developer workstations and build infrastructure that don’t look like a standard corporate fleet.
- Practical experience securing source code and developer infrastructure: source control platforms, CI/CD, secrets management, and cloud infrastructure.
- Working knowledge of NIST SP 800-171, CMMC, or a comparable federal framework—ideally having taken a company through an assessment—and the judgment to know what matters and what’s ceremony.
- Enough IT operations depth to run it well on your own for a while: MDM, identity providers and SSO, automated user lifecycle management, and multi-site networking.
- Comfort with identity and access architecture: SSO, MFA, least privilege, and access reviews at a pace that doesn’t exhaust people.
- A service mindset paired with strategic judgment. You take pride in fast, friendly support and in knowing which problems to solve permanently.
- Clear written communication. You document what you build, and you can explain a security decision to an engineer who disagrees with it—and change your mind when they’re right.
- Willingness to travel roughly 25% of the time between our offices.
- Due to the nature of our work and applicable export control regulations, this position requires U.S. person status (U.S. citizen or lawful permanent resident).