1 month ago
San Leandro, CA, USAMid Level
Responsibilities
- Own the security posture of AWS infrastructure managed through Terraform and Spacelift, including IAM policy review, secrets management, and network segmentation.
- Partner with engineering to integrate security into the SDLC and CI/CD pipeline through code scanning, dependency and vulnerability management, and secure defaults.
- Assess and secure control systems, OT environments, and data collection infrastructure.
- Operate security monitoring and detection tooling, triage alerts, investigate incidents, and expand detection coverage.
- Define access-control standards, including conditional access, least privilege, MFA, and IdP and SaaS-tool policies.
- Define MDM security baselines for macOS and Windows for IT implementation and maintenance.
- Build and lead incident response efforts and track security risks across the environment.
- Lay groundwork for applicable compliance frameworks and run security awareness efforts such as phishing simulations and training.
Requirements
- At least 4 years of security engineering experience spanning cloud security and application/DevSecOps work.
- Strong hands-on experience with AWS and Infrastructure-as-Code using Terraform.
- Practical identity-security experience with SSO/IdP policies, such as Okta, conditional access, and least-privilege design.
- Experience with security monitoring or detection platforms, including alert triage, tuning, and investigation.
- Understanding of secure SDLC practices including SAST, DAST, dependency scanning, secrets management, and security-focused code review.
- Ability to communicate risk clearly to non-security stakeholders and make pragmatic trade-offs in a small, fast-moving company.
- Preferred experience securing control systems, OT, industrial environments, data collection pipelines, CI/CD-integrated IaC workflows, or hardware and physical-system environments.
- Preferred experience building a security program from scratch, working with SOC 2, ISO 27001, NIST, or relevant sector frameworks, and using Python or Go for security automation.
- Must be comfortable serving as the sole dedicated security resource, responding outside standard business hours when needed, and obtaining relevant certifications such as AWS Security or GIAC/GSEC if necessary.
- Must be based in or willing to work from the San Leandro, California office and willing to travel occasionally to other Fuse locations.
- Must satisfy the stated ITAR eligibility requirements.
Benefits
- Medical, dental, and vision coverage.
- Relocation assistance for roles that require it.
- Flexible time off with no accrual tracking.
- Two weeks of paid time off built into the end of each year, subject to team and business needs.
- Supportive leave of absence policies and paid leave for new parents.
- The role is based in or requires willingness to work from the San Leandro, California office, with occasional travel and possible after-hours incident response.
About Fuse
Fuse is a youth-focused advertising agency that develops and runs brand strategy, experiential, social/digital, PR, and creative programs for teens and young adults. Privately held and founded in 1995, it is headquartered in Winooski, Vermont, and works across sports, music, fashion, gaming, and campus channels for consumer brands.