[Remote] Enterprise Security Engineer

Note: The job is a remote job and is open to candidates in USA. Oxide Computer Company is a technology company that treats corporate security as an engineering discipline focused on reducing operational risk. The Enterprise Security Engineer will own security across SaaS providers, endpoints, internal services, offices, signing ceremonies, compliance automation, incident response, and backup and recovery operations.

Responsibilities

• Manage the security lifecycle of third-party SaaS providers: user provisioning, access control, configuration, security review and ongoing tracking for compliance commitments
• Manage endpoint security for corporate machines, including MDM, help reason about where management tooling makes sense and where it doesn’t
• Secure and help operate internal corporate services: access control, log forwarding, service hardening, vulnerability management, backup and recovery
• Build automation for compliance evidence gathering, turning audit requests into automatic or easily repeatable processes
• Participate in security incident response: triage events, investigations, report writing, and general process improvement
• Manage security controls of physical office spaces
• Support offline keystore operations: planning ceremonies, writing and maintaining the tooling, take role assignments as needed for ceremonies
• Design backup and recovery solutions and perform periodic recovery testing
• Work directly with auditors and compliance partners and finding the balance between workable systems and compliance requirements

Skills

• Have an attacker's instincts, ideally sharpened by hands-on offensive work
• Believe in the importance of fully documenting your ideas, and you enjoy reading documentation produced by others
• Are eager to own cross-function initiatives across the company, working with various teams to design and implement solutions that work for everyone
• Are comfortable being a generalist
• Are proficient with Rust programming
• Are comfortable in Unix, Mac and Windows environments
• Believe security's job is to say "yes, and here's how", not "no, and here's why". When something is risky, you respond with actionable recommendations for doing it safely, rather than focusing on why something wouldn't work
• Are allergic to checkbox security. You care whether controls actually reduce risk, not whether it lets someone claim they weren't responsible when things go wrong. You're willing to own the outcomes of your recommendations, including those that don't pan out
• Treat compliance as an engineering problem. The compliance controls you manage are only those that you'd want anyway, regardless of compliance requirements. You would rather write tooling for compliance evidence gathering than periodically collect screenshots
• Look forward to running the MDM program at Oxide

Benefits

• Remote first
• Flexible working hours
• We offer the best medical PPO, dental, and vision plans we can find and cover 100% of premiums for employees and dependents.

Company Overview

Company H1B Sponsorship