Security Engineer

Job description

## **About Fuse** We are building one of the most potentially consequential companies of the century. Our mission is to accelerate the world's transition to fusion energy while safeguarding humankind. This is not a normal company. This is not a normal job. We are committed for the long term to win. ## **About the Role** We're hiring our first dedicated Security Engineer to own security across a growing and technically diverse footprint: cloud infrastructure, software development practices, control systems, and data collection pipelines. You'll work alongside our IT Systems Administrator, who owns day-to-day device/identity operations - you'll set the security strategy, standards, and technical controls, and partner with them on enforcement. This role sits at the intersection of cloud security, DevSecOps, and OT/control-systems security with real ownership from day one. ## **What We Value** - Obsess about the details — sloppy work costs us later, so do it right the first time. - Care — pick up the trash. Do things no one asks you to do. Go the extra mile because you care. - Act with urgency — every hour matters more than it feels like it does. - Be responsible for the outcome, not just the task; if it is not working, it remains your problem until it is fixed. - Assume good intent — disagree openly, then commit fully once a call is made. ## **Core Responsibilities** - Own security posture for AWS infrastructure managed via Terraform and Spacelift, including IAM policy review, secrets management, and network segmentation. - Partner with engineering to build security into the SDLC and CI/CD pipeline - code scanning, dependency/vulnerability management, secure defaults for new services. - Assess and secure control systems and data collection infrastructure. - Own and operate our security monitoring and detection tooling; triage alerts and build out detection coverage over time. - Define access-control standards (conditional access, least privilege, MFA policy) in IdP and across SaaS tools; partner with IT Admin on enforcement. - Define MDM security baselines (macOS/Windows) for IT to implement and maintain. - Build and lead incident response efforts when issues arise. - Track security risk across the environment and lay groundwork for relevant compliance frameworks as the company matures. - Run periodic security awareness efforts (phishing simulations, training) for a non-security-native team. ## **Minimum Qualifications** - 4+ years in a security engineering role spanning cloud security and application/DevSecOps work. - Strong hands-on experience with AWS and Infrastructure-as-Code (Terraform). - Practical experience with identity security — SSO/IdP policy (Okta or equivalent), conditional access, least-privilege design. - Experience with a security monitoring/detection platform (SIEM, EDR, or specialized tools) — alert triage, tuning, investigation. - Solid understanding of secure SDLC practices — SAST/DAST, dependency scanning, secrets management, code review for security issues. - Strong ability to communicate risk clearly to non-security stakeholders and make pragmatic trade-offs for a small, fast-moving company. ## **Preferred Qualifications** - Direct experience securing control systems, OT, or industrial environments. - Experience with CI/CD-integrated IaC workflows (Spacelift or similar). - Experience with data collection pipeline security (data integrity, sensor/telemetry access controls). - Prior experience as employee #1 or #2 on a security team, building programs from scratch. - Compliance experience (SOC 2, ISO 27001, NIST, or sector-specific frameworks relevant to hardware/control systems companies). - Scripting/automation skills (Python, Go) to build custom detections or automate security tooling. - Experience in a company where hardware, CAD/simulation workstations, or physical systems intersect with traditional IT. ## **Additional Requirements** - Comfortable being the sole dedicated security resource, setting strategy while partnering with IT for day-to-day enforcement. - Availability for incident response outside standard business hours when needed. - Based in or willing to work from our San Leandro, CA office given the control systems and hardware-adjacent scope of the role. - Occasional travel to other Fuse locations. - Willingness to obtain relevant certifications (e.g., AWS Security, GIAC/GSEC) if not already held, as the role and compliance needs mature. ## **Benefits** - Medical, dental, and vision coverage. - Relocation assistance for roles that require it. - Flexible time off. Take what you need, no accrual tracking. - 2 weeks of paid time off built into the end of each year (subject to team and business needs). - Supportive leave of absence policies. - Paid leave for new parents. ## **ITAR Requirements** To conform to U.S. Government technology export regulations, including the International Traffic in Arms Regulations (ITAR), you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State. ## **Equal Opportunity** Fuse is an Equal Opportunity Employer; employment with Fuse is governed on the basis of merit, competence, and qualifications and will not be influenced by race, color, religion, gender, national origin/ethnicity, veteran status, disability status, age, ancestry, immigration status, sexual orientation, gender identity, marital status, mental or physical disability, or any other legally protected status.